static nat + intrazone u-turn and interzone u-turn at same time

CMG — Tue, 26 Mar 2013 01:37:55 GMT

I'm currently having problems on PAN OS 5.0.1 replicating a standard Screenos MIP configuration. Whereby static nat and interzone/intrazone u-turn nat are all active at the same time.

We have multiple zones (5) all of the hosts inside each need to be able to access DMZ servers by their NATd public ip address (multiple dmz zones). Also unfortunately hosts inside the DMZ's sometimes want to talk back to themselves using their public ip address instead of their private.. Terrible I know..

Also when the DMZ servers talk to the internet they need to appear as their static natd public address.. when they talk to the internal (inside) network they appear as their standard private address..

Attached is a screenshot of the NAT configuration for 1 DMZ server..

The intrazone and interzone u-turn nating only work when the SNAT (static source translation) is not enabled..

Any thoughts?

I know we could be using split-dns.. and also this current design is begging for a re-architecture.. but we currently need to maintain status quo functionality for this firewall transition..

Re: static nat + intrazone u-turn and interzone u-turn at same time

Retired Member — Tue, 26 Mar 2013 10:35:13 GMT

So what is the problem with enable SNAT ?

Could you please clarify what is not working ? Thanks

topic static nat + intrazone u-turn and interzone u-turn at same time in General Topics

static nat + intrazone u-turn and interzone u-turn at same time

Re: static nat + intrazone u-turn and interzone u-turn at same time