topic Can Palo Alto be used as a reverse proxy? in General Topics

Can Palo Alto be used as a reverse proxy?

TSPI — Wed, 07 Aug 2013 10:49:04 GMT

We have this scenario that Palo Alto will receive the inbound mail then will be pass to the PMX server(pure message) going to the exchange server. After going to the exchange server, it must be forwarded to the FW but the problem is that the Core Switch doesn't have a default route configured. Is there any way that Palo Alto can receive the mail from the exchange server then send it across the internet? Can Palo Alto be use as reverse proxy?

Re: Can Palo Alto be used as a reverse proxy?

Retired Member — Wed, 07 Aug 2013 11:18:25 GMT

if you try the Nat suggestions below and it works please update.

Re: Can Palo Alto be used as a reverse proxy?

mikand — Sun, 11 Aug 2013 19:51:34 GMT

In this particular case, why not configure the route towards the PA instead? Or if this isnt possible perhaps settings up a tagged vlan if you dont want to fix (static) routing in your core?

Re: Can Palo Alto be used as a reverse proxy?

kprakash — Sun, 11 Aug 2013 20:19:02 GMT

Since the traffic hits inbound first on the PANFW firwall, and we are destination NATing the packets to the exchange server, configure a source NAT translation on the same NAT rule, and NAT ( IP and port) it to the IP address of the interface through which the exchange server is reachable on. This ensures that the traffic, when it leaves the firewall has the source IP as that of its interface, and destination interface as that of the exchange server. With this setting, the exchange server will respond to the IP address of the firewall, which is known internally in the network ( as a connected route, and for which the switch has a MAC table entry for ). Once this packet reaches the firewall, the firewall will perform the reverse Source and Destination NAT.

Hope this helps.

Best regards,

Karthik

Re: Can Palo Alto be used as a reverse proxy?

Tician — Thu, 12 Mar 2015 13:03:40 GMT

Have you talking about bidirectional NAT for this particular case, if so I think that is good solution....

Regards,

Predrag