topic Re: DMZ in General Topics

DMZ

CGilbride — Thu, 17 Aug 2023 21:12:33 GMT

We only have one public IP. Can I still set up a DMZ? If so, can someone point me to a good article on setting one up? I have found several but nothing that specifies if it is okay to set up using a single IP.

Re: DMZ

TomYoung — Thu, 17 Aug 2023 21:23:01 GMT

Hi @CGilbride ,

It is definitely possible to setup a DMZ with 1 public IP address. A DMZ is recommended for all inbound traffic.

You would create a private subnet in the DMZ and use NAT to map the 1 public IP to the private IP addresses. You could map different services (e.g., tcp/25, tcp/80, etc.) to different DMZ IP addresses. You could also use other options in the rule.

Thanks,

Tom

Re: DMZ

CGilbride — Thu, 17 Aug 2023 21:29:27 GMT

@TomYoung, thank you. I think I found an article that will help. It looks like I would just add my public IP to the Destination Address field in the security policy I create. I'm new to Palo Alto, and normally deal with internal network infrastructure, so setting up DMZs is not my specialty, working on adding to my skill set.

Re: DMZ

OtakarKlier — Thu, 17 Aug 2023 21:52:34 GMT

Hello,

Any protected subnet is technically a DMZ. Do you have services that are exposed to the internet?

Regards,

Re: DMZ

CGilbride — Thu, 17 Aug 2023 22:03:45 GMT

Hello @OtakarKlier, we do not.

Re: DMZ

reaper — Fri, 18 Aug 2023 11:36:31 GMT

here's an example NAT rule for a DMZ hosted webserver

In the original packet, you need to set untrust as source AND destination, this is because the original destination IP belongs to the external interface and the source IP originates from the internet. both of these zones are determined by doing a route lookup

if you set a service (in this case https:443) only that port is translated, leaving you with all the other destination ports untranslated and free for additional rules that point to different destinations (smtp, ftp,...)

in the Translated Packet, we set the destination server's private IP so NAT can be applied, and you can also change the final destination port, in case the server is running a service on a different port from the default (ports can both be changed pre- and post NAT e.g. 4443 becomes 443 or 443 becomes 8443 etc.

hope this helps

Re: DMZ

OtakarKlier — Fri, 18 Aug 2023 14:32:46 GMT

Hello,

Since you are not hosting any services that the people on the internet need to connect to, then all you need to do is create a security zone and vlan on the PAN. From there create the access policies as normal. This is now your protected vlan/DMZ. Also make sure you have a DENY ALL policy so its all allowed by exception.

Hope that makes sense.

Re: DMZ

CGilbride — Fri, 18 Aug 2023 14:48:51 GMT

Excellent!! thanks for the help.

Re: DMZ

CGilbride — Fri, 18 Aug 2023 14:49:25 GMT

Yes, I will test this out. Thanks for the excellent support!