topic Re: NAT for ldap in General Topics

NAT for ldap

jpzynski — Thu, 01 Aug 2013 20:04:14 GMT

I need to configure my PAN to allow LDAP and port 636 inbound from 10 specific IP addresses for authentication with a software company. Can't figure out how to do this correctly.

Re: NAT for ldap

kprakash — Thu, 01 Aug 2013 20:21:12 GMT

You can write a Destination NAT with the source IP address as the 10 IP adresses, the source zone as "untrust", the destination address with the public IP address of the ldap server, the destination zone as "untrust", service as 636 under the original packet section. Under the translated packet section, click on the check box of the "destination address translation" and give the private IP address of the ldap server.

Write a corresponding security rule with the source IP address as these 10 IP addresses, the source zone as "untrust", the destination IP address as the "public IP address of the server", the destination zone as "trust ( or DMZ, where the server is located), application = LDAP, service =any, and action= allow.

Best regards,

Karthik

Re: NAT for ldap

jpzynski — Thu, 01 Aug 2013 20:26:09 GMT

Thank you. Do I need to create each of the 10 IP addresses manually/individually in the PAN first or on the fly as part of the rule?

Re: NAT for ldap

kprakash — Thu, 01 Aug 2013 20:33:05 GMT

You could create address objects for these IP addresses, and use these address objects under the NAT and the security rules,if you want to identify the users based on a string / identity. You also have an option of adding these IP addresses on the fly when creating the new rules.

BR,

Karthik