topic Re: Configure NAT Policy for Exchange Server in General Topics

Configure NAT Policy for Exchange Server

OliveIT — Fri, 18 Jul 2014 23:39:47 GMT

We are brand new to Palo Alto and are configuring our first device, a PA-3020. We've been trying to configure a NAT policy that will direct inbound email to our Exchange server. Outbound email seems to work fine. Inbound email doesn't seem to be even hitting the firewall since there are no log entries. We have a Sonicwall firewall in place now and email works fine. When we move the cables from the Sonicwall to the PA-3020, inbound emails stop flowing. Any thoughts?

Re: Configure NAT Policy for Exchange Server

hshah — Fri, 18 Jul 2014 23:42:24 GMT

Hi Oliver,

Is it a Static NAT or just Destination NAT? Can you provide us snapshot of NAT configuration.

Regards,

Hardik Shah

Re: Configure NAT Policy for Exchange Server

hshah — Sat, 19 Jul 2014 00:05:56 GMT

Hi Oliver,

You can refer bellow mentioned video for DNAT.

Video Link : 1550

Regards,

Hardik Shah

Re: Configure NAT Policy for Exchange Server

_slv_ — Sat, 19 Jul 2014 18:30:13 GMT

Hello

If You are new to PAN please read Understanding PAN-OS NAT first, and next search this community for u-turn problems that could hit you

With regards

Slawek

Re: Configure NAT Policy for Exchange Server

pulukas — Sun, 20 Jul 2014 00:17:35 GMT

Sonicwall nat and policy organization is basically the same as you have in PanOS. They are separate and require two rules.

Look at your Sonicwall nat rule for the inbound address to the exchange server.

Create this same rule in the nat section on the PA

In the security policy add a rule on the PA to permit the inbound smtp application to the exchange server.

Once you have both the nat rule and security policy the inbound traffic should flow.

Re: Configure NAT Policy for Exchange Server

OliveIT — Mon, 21 Jul 2014 14:56:29 GMT

Thanks to everyone for your suggestions. Turns out we had it configured properly in the first place. The problem turned out to be the ARP table in the switch. The public facing IP had a MAC address pointing to the Sonicwall. When we moved the cables to the PA-3020, the switch was still trying to send the traffic to the Sonicwall. When we cleared the ARP table in the switch, traffic started flowing.