topic PAN OS enabling communication between overlapping subnets in General Topics

PAN OS enabling communication between overlapping subnets

JLoukota — Tue, 04 Jul 2023 13:38:17 GMT

Hello,

I am thinking about analogy with Cisco firewall. Please how can I make two hosts with same address communicate with one another on one firewall?

1) Two Virtual routers leaking with NAT in place between Virtual Routers. Directly on one FW, not with some external device. So in terms of routing "Next VR".

2) Two Virtual systems with separate Virtual routers. And NAT implemented on External zone, enabling bi-directional communication.

Of course I dont expect that a single host will communicate on itself, there will be some dummy address spaces used in NAT statements per VR as a destination addreses for the hosts.

Which of these two paths could lead to desired end?

Thank you

Best regards

Re: PAN OS enabling communication between overlapping subnets

reaper — Tue, 04 Jul 2023 15:27:04 GMT

Not having an overlap would be desirable 😉

Alternatively you could sourceNAT to the physical interfaces in the destination subnet so the "server" side has an IP+MAC in the same broadcast domain

Re: PAN OS enabling communication between overlapping subnets

JLoukota — Tue, 04 Jul 2023 18:31:03 GMT

Hello, thank you for the answer. So you mean that both my solutions are valid and yours is third?