topic Problem with interzone U turn NAT in General Topics

Problem with interzone U turn NAT

saint-paul — Thu, 31 Jan 2013 10:00:35 GMT

Hello,

I followed the instructions in the paloalto "understanding NAT-4.1RevC" pdf for implementing U turn NAT.

It works when I try to access a server in the DMZ from the trusted zone via it's public untrusted IP.

I have now a web server which somehow tries to do a http connect to it's own URL, which describes Case 5 in this document "server in the same zone as the client"

I followed the instructions:

NAT rule: DMZ-Zone to Untrust Zone with destination public IP translated to private IP and source translated to untrusted Interface and IP. I even created a security policy although the document says it is not needed as the traffic is in the same zone.

The problem is that I can't get it working the connection always times out, the same when I try to access the Public IP from an other server in the DMZ. I worked around the problem by setting up a DNS in the DMZ which points the URL to the servers private IP.

I can't see any traffic in the traffic logs which is probably due to the inter zone traffic.

Has anyone an idea why this isn't working?

Thanks

Re: Problem with interzone U turn NAT

rmonvon — Fri, 01 Feb 2013 19:04:39 GMT

Hi...Please try changing the source NAT from 'untrusted Interface and IP' to the interface and IP of the DMZ-zone. Thanks.

Re: Problem with interzone U turn NAT

saint-paul — Mon, 04 Feb 2013 14:18:14 GMT

Thank you, this solved the problem.

I had some strange glitch that the nat rule wouldn't accept to IP of the interface, it always reset to "none". I had to delete the rule and recreate it, after that I had to move the NAT rule up as it was shadowed by an other rule. It then finally worked.