Bi-Directional NAT using DMZ instead of Outside interface

CafNetMatt — Fri, 18 Apr 2014 22:44:13 GMT

The reason for this post is I'm collapsing 2 ASA that are configured one in front of the other into a single PANW firewall. The DMZ interface on the inside ASA is technically treated as the "outside" interface. All NAT is performed on this DMZ interface. After the collapse, the DMZ interface will still exist but a true Outside interface will not be there. NAT has to stay associated with the DMZ IP space because we only have a /30 for the Outside interface.

From reading the NAT Tech Note I think I understand this but wanted to run it by here just in case.

3 interfaces. Assume these are the zone names as well:

Inside 192.168.0.1/24

DMZ 2.2.2.1/24

Outside 1.1.1.1/30

Wireless 172.16.0.1/24

DMZ addresses are public IPs.

DMZ has servers assigned with IPs in this address space. The rest of the address space is used for bi-directional NAT.

Outside interface is the default route to the Internet.

Regular inside traffic going to the Internet is SNAT'ed via the Outside interface IP.

Wireless traffic going to the Internet uses a DMZ address for SNAT dynamic IP & port.

Creating a bi-directional NAT with the NAT address of 2.2.2.2 for internal server IP 192.168.0.2 would be:

Static

Src Zone Src IP Dst Zone NAT IP (bi-drectional = yes)

Inside 192.168.0.2 DMZ 2.2.2.2

For the Wireless subnet SNAT using 2.2.2.3, it would be:

Src Zone Src IP Dst Zone NAT IP (dynamic IP & port)

Inside 172.16.0.1/24 DMZ 2.2.2.3

The Dst Zone would be DMZ because when the route lookup is performed, the closest route is the directly connected route for the DMZ interface.

The Security Policy allowing Internet traffic to reach the internal server would be:

Src Zone Src IP Dst Zone Dst IP Action

Outside any Inside 2.2.2.2 Allow

Inside 192.168.0.2 Outside Any Allow

The security policy for the Wireless traffic would be:

Src Zone Src IP Dst Zone Dst IP Action

Wireless any Outside any Allow

Am I understanding this correctly?

Thanks.

Message was edited by: Matt Ausmus Updated to add wireless SNAT dynamic IP and port

Re: Bi-Directional NAT using DMZ instead of Outside interface

CafNetMatt — Sat, 26 Apr 2014 14:19:22 GMT

So, I got access to a PAN FW that I could use for testing and answered my question. For anyone else who happens across the issue here's what I found.

You can't use the bi-direction button. You have to create separate NATs for the DNAT & SNAT portions.

These are the NAT configs to be as close to bi-directional as possible. Outside IP is 2.2.2.2 and the inside server IP is 192.168.10.2

Static

Src Zone Src IP Dst Zone NAT IP (bi-drectional = no)

Inside 192.168.0.2 Outside 2.2.2.2

Translated Translated

Src Zone Src IP Dst Zone Address Port

Outside 2.2.2.2 DMZ 192.168.10.2 any

For the SNAT using a single IP NAT pool:

Src Zone Src IP Dst Zone NAT IP (dynamic IP & port)

Inside 172.16.0.1/24 Outside 2.2.2.3

The security policies listed above are correct.

topic Re: Bi-Directional NAT using DMZ instead of Outside interface in General Topics

Bi-Directional NAT using DMZ instead of Outside interface

Re: Bi-Directional NAT using DMZ instead of Outside interface