topic Re: Vip(DNAT not working) in General Topics

Vip(DNAT not working)

ArunKumar7 — Fri, 09 Feb 2024 06:48:26 GMT

This is my topology. From 30.0.0.10 i would like to access the server 192.168.0.2 with the help of PA wan interface IP(30.0.0.1)
I have created DNAT and Ssecurity policy .

Object Prenat IP is 30.0.0.1/8 and Webserver Ip is 192.168.0.2/24, when I try to open 30.0.0.1 from my web browser I am not able to see server's web page. I took a capture on server end and I don't see packet reaching the server.

Could you please help me to resolve the issue, am I missing somthing?

Re: Vip(DNAT not working)

reaper — Fri, 09 Feb 2024 08:24:17 GMT

your prenat IP should be 30.0.0.1/32 and postnat ip 192.168.0.2/32

if you add /8 and /24 subnets to the objects, you're telling your firewall to nat the entire /8 supernet somehow into the /24 subnet

your NAT rule needs to be:

from WAN to WAN 30.0.0.1/32 destination translate to 192.168.0.2/32

your security rule needs to be

from WAN to DMZ destination 30.0.0.1/32 any any allow