Isolate and NAT a segment for BYOD

sspivey — Mon, 05 Nov 2012 15:28:42 GMT

I've tried setting up a subnet on our local network for wireless BYOD purposes and our aim is to have phones/pads connect only on this subnet (10.84.0.0/16). An ACL on our layer 3 core switch prevents this subnet from communicating with other 10.x.x.x segments directly, where our other users and servers are set up.

We want to apply our filtering rules to internet access (Time of Day, URL/content, AV etc) and also force them to access our hosts/content as if they were on the untrusted side of the firewall. (basically make them 'go outside, then come back in' through the firewall)

I've set up DHCP to give an external resolver for DNS lookup, and I've added a dynamic NAT address rule for that subnet with an address on the untrusted interface, hoping that the BYOD subnet will route out through our internet addresses and back in.

What I see in the logs is 'incomplete' traffic to the NATed destination address, from an unNATed source address. ( zones: trust-> trust)

If I need to, I can set up another ethernet interface and zone, etc.

I'm wondering if there's a simple/elegant way to get this 'outside/inside' setup to work? (We're also running this HA - Active/Active so whatever gets implemented will need to live happily on 2 devices: 2x PA2050, PANOSv.4.1.7)

Thanks in advance.

Simon.

Re: Isolate and NAT a segment for BYOD

BobW — Tue, 06 Nov 2012 05:30:13 GMT

I did this so that our Ipads could get from their zone into the trust zone for activesync. Seems to me that using an external DNS might make it more difficult for more than a couple of servers. You can probably take the below and substitute in some ranges (i.e. the translated address can be a range). Of source you will need some security rules as well. Hope this helps.

Bob

Nat rule:

Original packet:

source zone-ipad zone

dest zone-Untrust

dest address-a public IP of PA

Translated packet:

type: Dynamic IP and port

address type: Interface address

interface: ethernet1/1 (interface of untrust zone)

IP address: A public facing IP different than the one above

translated address: Internal address of exchange server

topic Re: Isolate and NAT a segment for BYOD in General Topics

Isolate and NAT a segment for BYOD

Re: Isolate and NAT a segment for BYOD