topic Re: Problem with new internet connection in General Topics

Problem with new internet connection

WLitdepartment — Thu, 12 Sep 2013 20:04:52 GMT

I've just changed my internet connection to a new one.

Now I've reconfigured everything with the new address.

The issue is that I can surf the web from inside to outside but the NAT to my internal server is someway blocked.

What I can see in logs is:

I really don't know how to solve this issue.

The routing table is correct, but it seems that something is going wrong.

If I add a rule in security saying to pass everything nothing happens, but the error changes to "incomplete".

Can anyone help me?

Thanks a lot.

Pietro

Re: Problem with new internet connection

kprakash — Thu, 12 Sep 2013 20:12:30 GMT

Are we still using the older public IP address for the server for doing the destination NAT? If so, then this IP doesnt lie on the subnet of the new IP address.

Please follow the steps in the below doc that explains how to circumvent this issue.

https://live.paloaltonetworks.com/docs/DOC-4034

Thanks and best regards,

Karthik RP

Re: Problem with new internet connection

HULK — Thu, 12 Sep 2013 20:18:38 GMT

Hello,

Could you please click into the "magnifying glass" button and share the output.

Thanks

Re: Problem with new internet connection

kprakash — Thu, 12 Sep 2013 20:19:56 GMT

Found one more link provides a more accurate solution to our situation.

Destination NAT for a Network not Connected to the Firewall

Re: Problem with new internet connection

WLitdepartment — Thu, 12 Sep 2013 20:26:07 GMT

Karthik, thank for the quick response.

I've tryied with the document:

But still no luck:

Re: Problem with new internet connection

WLitdepartment — Thu, 12 Sep 2013 20:26:21 GMT

Re: Problem with new internet connection

WLitdepartment — Thu, 12 Sep 2013 20:29:14 GMT

Yep. Thank you too, Hulk:

Re: Problem with new internet connection

WLitdepartment — Thu, 12 Sep 2013 20:31:24 GMT

For your convenience the NAT is the following:

Re: Problem with new internet connection

WLitdepartment — Thu, 12 Sep 2013 20:33:17 GMT

With the following destination address translation:

And this virtual router:

Re: Problem with new internet connection

WLitdepartment — Thu, 12 Sep 2013 20:33:55 GMT

Sorry, this is the nat:

Re: Problem with new internet connection

hshah — Thu, 12 Sep 2013 20:38:09 GMT

Hi WLitdepartment ,

46.140.150.154 is the interface IP address, hence regular static Nat will not work, you will have to configure port address translation.

Please share access rule and NAT statement with us.

Regards,

Hardik Shah

Re: Problem with new internet connection

kprakash — Thu, 12 Sep 2013 20:49:54 GMT

Thanks for the clarification,

Per the screenshots, it appears that the users are connecting on port 443, whereas the destination NAT rule configured is for port 25. Can you remove the port 25 from the NAT rule ( Destination NAT to any port) , to see if it makes a difference?

IN addition, I see that the traffic is being identified as "not-applicable". We usually see "not-applicable" when we are filtering based on service ports too. So for testing purpose, please modify the inbound traffic policy to permit traffic from outside to inside, with source address any, destination address as 46.140.150.154, application set to ssl and smtp, and remove the service-port 25, and action allow.

Re: Problem with new internet connection

hshah — Thu, 12 Sep 2013 20:50:06 GMT

Traffic coming over port 443 while policy is configured for 25, please add port 443.

Re: Problem with new internet connection

HULK — Thu, 12 Sep 2013 20:50:27 GMT

Hello,

From the traffic logs it looks like:

1. Traffic coming from IP 95.227.104.14 to destination IP- 46.140.150.154 with Dst port 443.

2. As per the NAT rule, the same destination IP- 46.140.150.154 with Dst port 443 should translate to 192.168.0.220 with dst port 25.

3. For this traffic, Application is showing "Not-applicable"

Could you please modify your existing security policy and add "any" instead of any specific application and share the expanded output.

Please also share your security policy and NAT original packet o/p.

Thanks

Re: Problem with new internet connection

WLitdepartment — Thu, 12 Sep 2013 20:53:46 GMT

Yep, I was not so clear.

I'm trying a connection via https (owa) and mail (port 25).

This was my misunderstanding.

I'm completing a revert to the prevoiuos set of rules, to test the previous configuration.

In a while I'll add all of your requests.

Re: Problem with new internet connection

HULK — Thu, 12 Sep 2013 20:57:10 GMT

Otherwise, you can open a case with PAN support and share the case ID here. We will give you a call and continue to work on this issue.

Thanks

Re: Problem with new internet connection

WLitdepartment — Thu, 12 Sep 2013 21:08:00 GMT

I've found the issue.

The cache of the routing table didn't seem to work properly.

I've rebooted the device and now it works like a charme.

TOmorrow morning I'll post here the configuration for the natting with virtual router.

Thank to you all,

Pietro