topic Can only access DMZ server using private address, U-turn NAT not working in General Topics

Can only access DMZ server using private address, U-turn NAT not working

WilliamD — Tue, 13 Sep 2022 10:19:56 GMT

Configuring a new PA-850, new to this so go easy on me.

I have three zones, internal, outside, DMZ.

DMZ webserver

Private IP = 192.168.2.16

Public IP = 212.12.34.56

I have created two NAT rules as follows:

internal u-turn to DMZ

source zone = internal

dest zone = outside

dest address = 212.12.34.56

dest translated address = 192.168.2.16

external to DMZ

source zone = any

dest one = outside

dest address = 212.12.34.56

dest translated address = 192.168.2.16

For purposes of testing this is working I have created a security rule of ANY ANY.

I can only view the webserver from the internal network using the internal IP address of 192.168.2.16, using the FQDN or public IP I only get timeouts. Wireshark on the internal clients show outbound HTTP but Wireshark on the server shows no traffic inbound except when using 192.168.2.16.

The u-turn NAT rule is above the public NAT rule and the hide-NAT rule is last in the list. I am sure I am missing something simple but I have been through the how to u-turn video and guide here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEiCAK

The only thing I can see is there is also some source translation in the video which is not shown in the document but I think that is a red herring.

Any ideas?

Re: Can only access DMZ server using private address, U-turn NAT not working

OtakarKlier — Tue, 13 Sep 2022 19:10:43 GMT

Hello,

Make sure you have logging enabled on your policies and see where the traffic is flowing. I know you have your any any policy, but it might not be setup correctly. The thought I had was possible asymmetric routing. So check your virtual router and make sure everything is getting routed correctly.

Regards,

Re: Can only access DMZ server using private address, U-turn NAT not working

WilliamD — Wed, 14 Sep 2022 12:25:31 GMT

Plugging in the Outside interface into a small switch brought the interface up and the translation between internal and DMZ then occurred as expected. I don't remember seeing anything about this in the documentation but I guess a one-liner I may have missed.

Thanks for posting back OtakarKlier I did learn how to use the monitor a little so it wasn't a waste of time.