PBF Rule Does Not Match Traffic to or from the Firewall Directly

Issue

The PBF Rule does not match traffic to or from the firewall directly.

Resolution:

This is normal behavior, an ANY traffic that is sourced from the Palo Alto Netowrks firewall or sent directly to sslvpn/ipsec/gp/etc will skip the PBF lookup and use the routing table.

Note: Due to this behavior, do not use a ping sourced from the device to test PBF functionality. The packet has to ingress one of the firewall interfaces.

owner: dburns