topic Re: External virtual network pointing to many internal ip in Next-Generation Firewall Discussions

External virtual network pointing to many internal ip

Bouthaina — Wed, 15 Jan 2025 14:45:17 GMT

hello,

We are migrating from forcepoint to PA. we face the case below: a virtual network (172.28.66.0/24) is assigned to multiple servers , behind it , there is a group for Such LB in FPT (pointing on 28.66.0 means : one for 172.28.72.2 and 172.28.72.3 for exemple). in PALOALTO, i created DNAT rules for dynamics load balancing between addresses. but , using virtual network that does not exist is posing problem. because all servers are represented as 172.28.66.0 but backend is other networks. how should i declare zones in dnat rules for that virtual network.

thanks

Re: External virtual network pointing to many internal ip

Raido_Rattameister — Wed, 15 Jan 2025 15:16:01 GMT

Do I understand correctly that you want to use "172.28.66.0" as destination IP in NAT rule on "Original Packet" tab but you don't have any interface inside 172.28.66.0/24 zone and no route towards 172.28.66.0/24 in routing table?

In this case you need to use UNTRUST (or whatever represents your Internet zone) in NAT policy as in this case Palo matches destination zone based on 0.0.0.0/0 default route.

In Security policy you still use Post-NAT zone as destination (so wherever your 172.28.72.x servers are).

Re: External virtual network pointing to many internal ip

Bouthaina — Wed, 05 Feb 2025 09:21:32 GMT

hello @Raido_Rattameister ,

thank you for response . i have tested it in lab and even in the costumer infrastructure. that worked !

FYI.

😊