topic Re: One-to-One NAT - DMZ to inside - how do I make it work? in General Topics

One-to-One NAT - DMZ to inside - how do I make it work?

darren_g — Mon, 26 Aug 2013 03:44:30 GMT

Folks.

I'm apparently having a particularly stupid day, because I can;t make something as simple as one-to-one NAT work.

Scenario is this.

I have an IP in my DMZ. I have assigned this IP to a particular server which is hosted on my INSIDE (secure) network.

All I want to do is take this IP address and NAT it to the inside address. Something like this

IP addresses have been changed to protect the stupid (me!).

So - request comes in from the web to 1.2.3.91, and I want to redirect it to 10.100.1.120 - only needs web browsing and PING.

but I can not, for the life of me, get it right.

I've got the following NAT rule

Original packet

Source Zone - Outside

Destination Zone - DMZ

Source Address - Any

Destination Address - 1.2.3.91

Translated Packet

Source Translation : None

Destination translation : 10.100.1.120

The security policy is as follows

Source : Outside

Source Address : Any

Destination : Inside

Destination Address : 10.100.1.120

I'm happy for anyone to point out where I'm being stupid and laugh at me - I know it's something obvious, but I'm banging my head trying to sort out what.

thanks

Re: One-to-One NAT - DMZ to inside - how do I make it work?

HULK — Mon, 26 Aug 2013 04:01:36 GMT

Apply the NAT from Zone --" Outside" to zone" Outside". NAT lookup happens PANFW before translate the original packet ( Public IP address).

Thanks

Re: One-to-One NAT - DMZ to inside - how do I make it work?

HULK — Mon, 26 Aug 2013 04:08:02 GMT

Hello Sir,

Please go through the below mentioned documents.

Understanding PAN-OS NAT >>>>>>> Page No 15

Thanks

Re: One-to-One NAT - DMZ to inside - how do I make it work?

HULK — Mon, 26 Aug 2013 04:17:05 GMT

Hello,

Please find below an example of One-to-one NAT.

Hope it helps.

Thanks

Re: One-to-One NAT - DMZ to inside - how do I make it work?

darren_g — Mon, 26 Aug 2013 04:26:40 GMT

HULK wrote:

Hello Sir,

Please go through the below mentioned documents.

Understanding PAN-OS NAT >>>>>>> Page No 15
     

Thanks

Did that before I asked the dumb question. As far as I can tell, what I have now configured matches - and the damn thing still isn't working.

Re: One-to-One NAT - DMZ to inside - how do I make it work?

UhMayYeah — Mon, 26 Aug 2013 05:53:59 GMT

Can you try to add a static route for 1.2.3.91/32 reachable through DMZ interface.

Make sure the packets are being received on the firewall using traffic logs.

P.S: Without addition of this static-route ,NAT rule Outside to Outside should be able to translate these packets.

Try refreshing arp table of the upstream router.

>test arp gratuitous ip 1.2.3.91 interface <outside interface>

Re: One-to-One NAT - DMZ to inside - how do I make it work?

darren_g — Mon, 26 Aug 2013 06:57:52 GMT

Nadir wrote:

Can you try to add a static route for 1.2.3.91/32 reachable through DMZ interface.
Make sure the packets are being received on the firewall using traffic logs.

Not sure what you mean - add a static route for 1.2.3.91/32 *where*?

I can see *one* packet (session) which made it through, at some point in the past (I've tweaked the config file so many times since then trying different options I've lost track). I've gone back through the config logs and returned the config to exactly what it was back then - once it commits, I'll try again.

Nadir wrote:

P.S: Without addition of this static-route ,NAT rule Outside to Outside should be able to translate these packets.

Try refreshing arp table of the upstream router.

>test arp gratuitous ip 1.2.3.91 interface <outside interface>

The gratuitous arp fails, vis-a-vis

Server error : cannot send gratuitous ARP

Rolling the config back did me no good at all. I'm at an absolute loss here. I *must* be doing something stupid, I just can't figure out what!

Re: One-to-One NAT - DMZ to inside - how do I make it work?

UhMayYeah — Mon, 26 Aug 2013 07:03:15 GMT

Please Allow the Original address 1.2.3.91 in the Security rule.

Source : Outside

Source Address : Any

Destination : Inside

Destination Address : 10.100.1.120

Change to :

Source : Outside

Source Address : Any

Destination : Inside

Destination Address : 1.2.3.91

Re: One-to-One NAT - DMZ to inside - how do I make it work?

HULK — Mon, 26 Aug 2013 19:31:08 GMT

Hello Darren,

Could you please provide a snapshot of traffic log for this destination ( internal server IP 10.100.1.120).

Example:

Thanks

Re: One-to-One NAT - DMZ to inside - how do I make it work?

darren_g — Mon, 26 Aug 2013 23:04:39 GMT

akawimandan wrote:

Please Allow the Original address 1.2.3.91 in the Security rule.

Source : Outside

Source Address : Any

Destination : Inside

Destination Address : 10.100.1.120

Change to :

Source : Outside

Source Address : Any

Destination : Inside

Destination Address : 1.2.3.91

Done that. I put *both* the inside (RFC1918) address and the outside (real) address in the allowed destinations and it still didn't work. I've now put just the outside address, and still no good.

Re: One-to-One NAT - DMZ to inside - how do I make it work?

UhMayYeah — Tue, 27 Aug 2013 00:49:20 GMT

Can you add a packet-filter and monitor the Global counters for the packet-filter for the source IP (Monitor>Packet Filter)

Initiate a PING to the destination (Public DMZ) ,and verify if the packets are making it to the firewall using the following command:

>show counter global filter packet-filter yes delta yes (Run multiple times )

Re: One-to-One NAT - DMZ to inside - how do I make it work?

darren_g — Tue, 27 Aug 2013 01:37:04 GMT

HULK wrote:

Hello Darren,

Could you please provide a snapshot of traffic log for this destination ( internal server IP 10.100.1.120).

Example:

Thanks

No, I can't because there is *nothing* in the logs for the internal IP address. Or the external one, for that matter!

Re: One-to-One NAT - DMZ to inside - how do I make it work?

darren_g — Tue, 27 Aug 2013 02:00:11 GMT

akawimandan wrote:

Can you add a packet-filter and monitor the Global counters for the packet-filter for the source IP (Monitor>Packet Filter)

Initiate a PING to the destination (Public DMZ) ,and verify if the packets are making it to the firewall using the following command:

>show counter global filter packet-filter yes delta yes (Run multiple times )

Well, I'm definitely able to capture the incoming PING packets going to the destination IP, so I'm not going nuts and losing it somewhere. The PCAP shows it clearly.

Damned if I can figure out WHY this isn't working, though.

Re: One-to-One NAT - DMZ to inside - how do I make it work?

HULK — Tue, 27 Aug 2013 02:14:09 GMT

Hello Darren,

Thanks for the update. As per my understanding, packets are getting dropped before creating the flow into this firewall. So, please follow the instructions given by akawimandan and take an output of >show counter global filter packet-filter yes delta yes (Run multiple times ).

Thanks

Re: One-to-One NAT - DMZ to inside - how do I make it work?

darren_g — Tue, 27 Aug 2013 04:13:07 GMT

Well, the packets are definitely being dropped by the firewall.

I've setup 3 PCAP's so far - stage "receive", stage "firewall" and stage "drop".

The "receive' and "drop" stages show packets. The "firewall" stage does not.

The output of the command above is shown below

Global counters:

Elapsed time since last sampling: 192.637 seconds

name value rate severity category aspect description

--------------------------------------------------------------------------------

pkt_sent 1 0 info packet pktproc Packets transmitted

pkt_outstanding 1 0 info packet pktproc Outstanding packet to be transmitted

pkt_alloc 1 0 info packet resource Packets allocated

flow_policy_deny 7 0 drop flow session Session setup: denied by policy

flow_host_pkt_xmt 1 0 info flow mgmt Packets transmitted to control plane

appid_ident_by_icmp 7 0 info appid pktproc Application identified by icmp type

--------------------------------------------------------------------------------

Total counters shown: 6

--------------------------------------------------------------------------------

"Session setup denied by policy" - sounds ominous - which policy is denying it?

Re: One-to-One NAT - DMZ to inside - how do I make it work?

HULK — Tue, 27 Aug 2013 04:31:26 GMT

Hello Darren,

Please try below mentioned CLI command and share the O/P.

admin@62-PA> test security-policy-match from <source zone> source <IP address> destination <IP/MASK> protocol YY destination-port XX

admin@62-PA> test nat-policy-match source <IP public address> destination <IP address> protocol YY destination-port XX

Thanks

Re: One-to-One NAT - DMZ to inside - how do I make it work?

darren_g — Tue, 27 Aug 2013 05:24:15 GMT

HULK wrote:

Hello Darren,

Please try below mentioned CLI command and share the O/P.

admin@62-PA> test security-policy-match from <source zone>  source <IP address> destination <IP/MASK> protocol YY destination-port XX

admin@62-PA> test nat-policy-match source <IP public address> destination <IP address> protocol YY destination-port XX

Thanks

first one (I've replaced the actual outside address)

darren@Ai-Gate(active)> test security-policy-match from outside source 110.142.210.164 destination 1.2.3.91/32 protocol 1

Confluence-Outside-in {

from outside;

source any;

source-region none;

to inside;

destination 1.2.3.91;

destination-region none;

user any;

category any;

application/service [ icmp/icmp/any/any web-browsing/tcp/any/80 ping/icmp/any/any ];

action allow;

terminal yes;

}

Second one

darren@Ai-Gate(active)> test nat-policy-match source 110.142.210.164 destination 1.2.3.91 protocol 1

Destination-NAT: Rule matched: Inbound NAT Confluence

1.2.3.91:0 => 10.100.1.120:0

darren@Ai-Gate(active)>

I can't see a problem with either one, yet I can't PING the damn thing from the outside! I've definitively confirmed the host is online, has no local firewall running, and has a route to the internet. The NAT rule for this incoming is placed "above" my general-purpose NAT rules, so it should be processed first.

I am now officially scratching my head.

Re: One-to-One NAT - DMZ to inside - how do I make it work?

UhMayYeah — Tue, 27 Aug 2013 05:49:06 GMT

Can you add the o/p for following commands to this discussion

>show running nat-policy

>show routing route

Also start a continuous ping to the DMZ public IP and monitor the session table:

>show session all filter source <ip>

if you see any PING sessions displayed add the following o/p with this discussion

>show session <id>

Re: One-to-One NAT - DMZ to inside - how do I make it work?

darren_g — Tue, 27 Aug 2013 22:13:25 GMT

akawimandan wrote:

Can you add the o/p for following commands to this discussion
>show running nat-policy


>show routing route


Also start a continuous ping to the DMZ public IP and monitor the session table:


>show session all filter source <ip>


if you see any PING  sessions displayed add the following o/p with this discussion

>show session <id>

Running nat policy (somewhat obfuscated) - there are other components, but they refer to interfaces which aren't part of this problem.

"Inbound NAT Confluence" {

from outside;

source any;

to outside;

to-interface ;

destination 1.2.3.91;

service any/any/any;

translate-to "dst: 10.100.1.120";

terminal no;

}

No-NAT-DMZ {

from inside;

source any;

to DMZ;

to-interface ethernet1/3 ;

destination any;

service any/any/any;

terminal no;

}

"No-NAT Internet Router" {

from inside;

source any;

to outside;

to-interface ethernet1/2 ;

destination 1.2.3.2;

service any/any/any;

terminal no;

}

No-NAT-inbound-DMZ {

from outside;

source any;

to DMZ;

to-interface ethernet1/3 ;

destination any;

service any/any/any;

terminal no;

}

"Outbound Nat" {

from inside;

source any;

to outside;

to-interface ;

destination any;

service any/any/any;

translate-to "src: ethernet1/2 1.2.3.1 (dynamic-ip-and-port) (pool idx: 1)";

terminal no;

}

Some explanation - I have a /24 available on my router/firewall. 1.2.3.0/30 is used as a point-to-point link between my edge router running BGP and my firewall (1.2.3.1/30 is the firewall's "outside" interface)

My DMZ is 1.2.3.64/26, with 1.2.3.91 being one IP inside that range - the firewaall has 1.2.3.126 on the layer 3 interface for the DMZ.

Routing table (again, somewhat obfuscated)

VIRTUAL ROUTER: default (id 1)

==========

destination nexthop metric flags age interface next-AS

0.0.0.0/0 1.2.3.2 10 A S ethernet1/2

10.0.243.0/24 10.100.100.250 10 A S ethernet1/1

10.0.244.0/24 10.100.100.250 10 A S ethernet1/1

10.0.250.8/29 0.0.0.0 10 A S tunnel.5

10.0.250.16/29 0.0.0.0 10 A S tunnel.4

10.0.250.24/29 0.0.0.0 10 A S tunnel.6

10.0.252.0/24 10.100.100.250 10 A S ethernet1/1

10.0.253.0/24 10.100.100.250 10 A S ethernet1/1

10.0.254.0/24 10.100.100.250 10 A S ethernet1/1

10.10.0.0/24 10.10.0.0 10 A S tunnel

10.10.1.0/24 0.0.0.0 10 A S tunnel.3

10.50.0.0/24 10.100.100.250 10 A S ethernet1/1

10.50.1.0/24 10.100.100.250 10 A S ethernet1/1

10.50.10.0/24 10.100.100.250 10 A S ethernet1/1

10.50.12.0/24 10.100.100.250 10 A S ethernet1/1

10.50.13.0/24 10.100.100.250 10 A S ethernet1/1

10.50.14.0/23 10.100.100.250 10 A S ethernet1/1

10.50.16.0/24 10.100.100.250 10 A S ethernet1/1

10.50.17.0/24 10.100.100.250 10 A S ethernet1/1

10.50.50.0/24 10.100.100.250 10 A S ethernet1/1

10.100.1.0/24 10.100.100.250 10 A S ethernet1/1

10.100.2.0/24 10.100.100.250 10 A S ethernet1/1

10.100.3.0/24 10.100.100.250 10 A S ethernet1/1

10.100.4.0/24 10.100.100.250 10 A S ethernet1/1

10.100.5.0/24 10.100.5.254 0 A C ethernet1/4

10.100.5.254/32 0.0.0.0 0 A H

10.100.100.248/30 10.100.100.249 0 A C ethernet1/1

10.100.100.249/32 0.0.0.0 0 A H

172.20.12.0/24 10.100.100.250 10 A S ethernet1/1

192.9.200.0/24 0.0.0.0 10 A S tunnel.3

1.2.3.0/30 1.2.3.1 0 A C ethernet1/2

1.2.3.1/32 0.0.0.0 0 A H

1,2,3.64/26 1.2.3.126 0 A C ethernet1/3

1.2.3.126/32 0.0.0.0 0 A H

total routes shown: 34

I'm not seeing any sessions in the session table at all with a continuous PING running from an outside address to the host in question, but I *do* see sessions if I run one to another host in the DMZ, so I'm pretty sure the routing is right.