Objectives
The simulator ticks each one as soon as the network meets it.
Rule PUB-WEB names the real address 172.16.1.10. It must name the public address: 203.0.113.10.
Rule BLOCK-ALL sits above OUT, and the first match wins: move OUT to the top.
show config diff shows a route that was fixed and never committed. Commit.
LAP1 reaches the server on port 80, and PC1 reaches 198.51.100.1.
Before you start
Read the Traffic Log, or use test security-policy-match. The firewall runs what was committed, not what is in the candidate: compare show config running with show config candidate.
Concept
A security rule: the address before NAT, the zone after NAT
To publish a server, the NAT rule goes from untrust to untrust, because before NAT the public address is out there. The security rule goes from untrust to the server’s real zone, and still names the public address. Its two halves come from different moments in the packet’s life.
Concept
The candidate waits for commit
A PAN-OS-style firewall keeps two configurations. Your changes go into the candidate, and the firewall keeps running the old one until you commit. If the candidate has an error, the commit fails and nothing changes.
