topic Re: need help with u-turn nat between zones in General Topics

need help with u-turn nat between zones

mstevenson — Thu, 07 Apr 2011 14:32:13 GMT

Hi all

I have read through the NAT tech notes and manuals from this site but canot seam to get this feature to work, i have u-turn nat enabled and working brilliantly in the same zone but i cant get the u-turn feature to work between zones/seperate networks. Let me explain our setup and any help would be very appreciated.

Guest Client Network

Source - Guest Laptop: 192.180.0.10

Dest - External webmail IP address: 89.248.148.200

Internal Corporate Network

Internal webmail server: 172.16.0.10

I need users to be able to access the external address of the webmail server from the guest client network. What i would like is so when users on the guest network access the webmail external ip it is routed through the PA and is then routed to the internal network zone. I have setup the u-turn feature in the same zone and that works great, its just when i am trying to do u-turns with different zones that i cant get it to work. I have followed the guide NAT Tech Notes to set the NAT and security rules for the u-turn between zones but they dont seam to be working. Any help would be great!!

Matt

Re: need help with u-turn nat between zones

bpappas — Thu, 07 Apr 2011 14:37:20 GMT

Can you post a screenshot of the NAT rules you configured and a sketch of the network? Seeing this would probably allow us armchair quarterbacks to help figure this out.

-Benjamin

Re: need help with u-turn nat between zones

mderksen — Thu, 07 Apr 2011 14:59:29 GMT

From your text I would say the configuration should look like:

NAT: Source Zone; Guestnetwork, Destination Zone; External, Destination; 89.248.148.200, trans dest; 172.16.0.10

Security: Source Zone; Guestnetwork, Destination Zone; Internal, Source IP; guest subnet, Dest IP; 89.248.148.200

But indeed a snapshot from what you configured could help.

Marcel

Re: need help with u-turn nat between zones

jochristian — Fri, 20 May 2011 11:30:23 GMT

Did you find a solution on this problem? Seems like i'm stuck on a similiar problem.

Jo Christian

Re: need help with u-turn nat between zones

zanonibs — Sat, 21 May 2011 21:17:38 GMT

The DNS-proxy feature of PAN 4.x can be useful without using U-turn nat.

Re: need help with u-turn nat between zones

sherwin33 — Wed, 21 Aug 2013 08:33:13 GMT

Hi,

Thanks for this. I had the same problem for our guest wireless, needing to access out internal web servers. Using the above NAT and Security policies got this to work!!

Re: need help with u-turn nat between zones

mbutt — Wed, 21 Aug 2013 18:27:26 GMT

The following doc has a good use case example of U-Turn on page 22

https://live.paloaltonetworks.com/docs/DOC-1517

Let us know if this helps.

Thanks

Numan