topic Re: Policies security and NAT are bidireccional??? in General Topics

Policies security and NAT are bidireccional???

soporteseguridad — Wed, 24 Jul 2013 09:08:22 GMT

If there is a security policy applied from just "untrust to trust" permitting SSH traffic .. this rule will be bidirectional??? or i would need to create other rule from trus to trust permitting SSH???

Its the same with NAT rules???

thanks

Re: Policies security and NAT are bidireccional???

soporteseguridad — Wed, 24 Jul 2013 09:13:43 GMT

or i would need to create other rule from untrust to trust permitting SSH???

Re: Policies security and NAT are bidireccional???

kprakash — Wed, 24 Jul 2013 13:43:35 GMT

Good Morning,

From what I understand, you wanna create a security rule from Untrust to Trust, so that people from the internet can access a server that is behind the firewall on the trust zone. If the users from the internet initiate a new ssh session to the firewall, then the firewall receives a SYN packet from the untrust to the trust zone. We need not write a new policy for the SYN-ACK from the trust to untrust to go out, and the firewall will match any the server to client traffic on ssh to the same "untrust to trust" rule that you created. So it depends upon who is initiating the session. If someone is initiating a new ssh connection from the trust zone, we would then require a policy from "trust to untrust" allowing ssh.

Bear in mind that when we have an inbound connection from the internet ( untrust to trust), the NAT rules are written slightly differently, and you may wanna refer to the destination NAT configuration as mentioned under page 15 of the NAT tech note,

https://live.paloaltonetworks.com/docs/DOC-1517

BR,

Karthik

Re: Policies security and NAT are bidireccional???

Gregoux — Wed, 24 Jul 2013 16:08:51 GMT

first scenario

when

a client have to established session on a server with a source NAT to the aim of masking the ip of the client or for routing purpose. you just need a static NAT without bidirectionnal option.

second scenario

if you create a static nat with the bidirectional option and with a destination address declared.

you have the same behaviour, but its like you create another nat rule but a destination nat rule that allow the server to initiate a connection on your client of the first scenario

that make sens?