topic ONE External IP to MANY Internal IP NAT in General Topics

ONE External IP to MANY Internal IP NAT

greeng — Wed, 03 Dec 2014 20:29:01 GMT

I believe I know the answer after looking around.

We have NATs that work fine when it is 1to1.

But what about 1 External IP that represents many Internal Hosts? We have multiple websites that when you do a lookup in DNS, they all point to a singular public facing IP. That public facing IP is represented by our ISA.

External Internal

mysite.org - xxx.xxx.67.18 > 192.168.1.20

mysite1.org - xxx.xxx.67.18 > 192.168.1.21

mysite2.org - xxx.xxx.67.18 > 192.168.1.22

Could this be done by changing addresses (Objects > Addresses) to use FQDN instead of IP?

So the thought there would be:

2 New Objects

------------------

Name: mysite.org (outside) - FQDN: mysite.org

Name: mysite.org (inside) - IP Address: 199.168.1.20

NAT Policy

-----------------

Src: untrust

Dst: untrust

Src Addr: Any

Src Addr: mysite.org (outside)

Dst Addr Translation: mysite.org (inside)

Security Policy

-------------------

Src: Any

Dst: mysite.org (outside)

Thoughts?

Re: ONE External IP to MANY Internal IP NAT

HULK — Wed, 03 Dec 2014 20:52:07 GMT

Hello greeng,

The above mentioned setup will work fine if you are running internal servers on different port. For an example:

External Internal

mysite.org - xxx.xxx.67.18 Port-80 > 192.168.1.20 -port-80

mysite1.org - xxx.xxx.67.18 port-8080 > 192.168.1.21 -port-8080

mysite2.org - xxx.xxx.67.18 port-443 > 192.168.1.22 port 443

NAT/security policy should be configures as mentioned below:

Name: mysite.org (outside) - FQDN: mysite.org

Name: mysite.org (inside) - IP Address: 199.168.1.20

NAT Policy

-----------------

Src: untrust

Dst: untrust

Src Addr: Any

Service: http/https or custom service

Destination Addr: mysite.org (outside)

Dst Addr Translation: mysite.org (inside)/192.168.1.21/192.168.1.22

Security Policy

-------------------

Src: Any

Dst: mysite.org (inside)

Hope this helps.

Thanks

Re: ONE External IP to MANY Internal IP NAT

sbabu — Wed, 03 Dec 2014 21:09:11 GMT

Hi greeng,

The mentioned setup will work if you are running internal server with different private IP address. Please find the below example for the same.

External Internal

mysite.org - xxx.xxx.67.18 Port-2000 > 192.168.1.20 -port-80

mysite1.org - xxx.xxx.67.18 port-2001 > 192.168.1.21 -port-80

mysite2.org - xxx.xxx.67.18 port-2002 > 192.168.1.22 port 80

NAT/security policy should be configures as mentioned below:

Name: mysite.org (outside) - FQDN: mysite.org

Name: mysite.org (inside) - IP Address: 192.168.1.20

NAT Policy

-----------------

Src: untrust

Dst: untrust

Src Addr: Any

Services : External Port ( Ex : 2000, 2001, 2002)

Destination Addr: mysite.org (outside)

Dst Addr Translation: mysite.org (inside)

Dst port : 80

Security Policy

-------------------

Src: untrust

Dst: trust

Dst addr : mysite.org (outside)

Regards,

Sarath

Re: ONE External IP to MANY Internal IP NAT

greeng — Wed, 03 Dec 2014 21:40:39 GMT

Thank you HULK and sbabu

I'm going to do some testing.

Re: ONE External IP to MANY Internal IP NAT

HULK — Wed, 03 Dec 2014 21:44:48 GMT

You are welcome. Let us know how it goes :smileygrin:

Thanks

Re: ONE External IP to MANY Internal IP NAT

sbabu — Thu, 04 Dec 2014 16:49:02 GMT

Also you can use the below document for your reference

Understanding PAN-OS NAT

Page 19& 20

Thank you.

Re: ONE External IP to MANY Internal IP NAT

Dz3015 — Thu, 11 Dec 2014 15:14:05 GMT

I agree with Hulk.

The only way you can do a "1 to many" NAT is via PAT. You must set up separate ports for each connection.

Re: ONE External IP to MANY Internal IP NAT

mivaldi — Thu, 11 Dec 2014 19:40:01 GMT

This video tutorial will help you with the DNAT configuration.

Video Link : 1550