topic Sample Configs in General Topics

Sample Configs

pko — Sun, 26 Aug 2012 19:03:16 GMT

Are there any links or references to a complete sample config for the PA firewall? I would like to see complete NAT examples and security policies for both inbound and outbound traffic. The Understanding NAT guide covers the inbound policy but not the outbound and does not cover all security policies. Also, I am looking for examples of security and NAT policies for traffic from the public to a dmz, dmz to private, and private to public. If anyone has a configuration or guide that can be looked at, I would appreciate it.

Re: Sample Configs

mikand — Sun, 26 Aug 2012 21:22:12 GMT

Could these docs be the ones you are looking for?

Re: Sample Configs

pko — Sun, 26 Aug 2012 21:50:41 GMT

That is not quite what I am looking for, I am looking more specifically for NAT and security policy examples for inbound/outbound traffic and best practices. For example, I have 10 devices that each need their own public ip and are static natted and are only allowed to communicate with a specific range of ip address on the Internet. I am also looking for what others are configuring for Exchange rules and examples and nat rules for inbound OWA and Activesync from the public to a dmz and then the dmz to private rules (no nat) and the corresponding reply rules. I have Juniper SRX and Pix experience and am looking for some correlation on these rules. I have no issues with the interfaces or security zones, I am just looking for more complete examples/best practices to show the nat and security rule flow from users in public internet to webmail server in dmz and then from webmail server to mailbox server in private zone and the corresponding reply rules.

Re: Sample Configs

drwillis07 — Mon, 27 Aug 2012 15:04:24 GMT

Paula,

Please look at the document - Understanding NAT found here: https://live.paloaltonetworks.com/docs/DOC-1517 It contains examples of several common scenarios for both source and destination NAT which should address your needs for DMZ servers.