application level gateway firewall protect the network for specific

With Prisma Access it will be harder as then different tenants will be needed (there can't be more than one device group connected to a Prisma Access tenant) and tenant to tenant routing seems like a nightmare and this is why I opened another question just to check it. I am starting to thing that redirecting a specific traffic to a firewall that is with ALG dissabled could be the best way. Is there a way to dissable the SIP ALG function not globally and not and app overide policy? Maybe it is better to create a custom ALG is the option ' Continue scanning for other Applications' but if the SIP ALG disabled globally will the ' Continue scanning for other Applications' work as how is this different than the real ALG functons in the firewall ?Īlso I think that custom ports can't be open on the firewall with custom application sifnatures but I could be wrong. From what I read about ALG ( Application Level Gateway) functions on the Palo Alto Firewalls this function if needed is disabled globaly for the SIP default application or with application overide policy but this will stop the SIP signature matches.

Application level gateway firewall protect the network for specific