topic Re: NAT exclude in General Topics

NAT exclude

cryptochrome — Sat, 25 May 2013 12:09:31 GMT

Hi,

is it possible to make exceptions/exclusions for a NAT rule? Think of this scenario:

small PA-200 setup
only one external/public IP address
that IP address is used for a lot of incoming NAT
the NAT rule basically forwards everything from the external IP to an internal host
now I also want to enable GlobalProtect and incoming VPN connections on the external Interface

Problem:

Due to the "global NAT" rule mentioned above, incoming VPN/GP traffic would also be NATed to the internal Host.

Tried:

I tried to put a NAT rule above the forementioned global NAT rule with the same match criteria, adding service-https and disabling all destination translation options. I thought this would disable NAT for HTTPS. But it didn't work.

Ideas?

Thanks!

Re: NAT exclude

Retired Member — Sat, 25 May 2013 12:23:35 GMT

if your 443 port is used by another internal service try to use different port for global protect and make an internal portal.

https://live.paloaltonetworks.com/docs/DOC-3457

Re: NAT exclude

cryptochrome — Sat, 25 May 2013 12:41:49 GMT

That's a good idea, thanks. But I need to exclude other services, it's not just GP. For example, I need to terminate IPSec VPNs on the external interface. Or could I I use the same approach you described for that (e.g. terminate VPN on a loopback and NAT ipsec/ike to the loopback address)?

Re: NAT exclude

Retired Member — Sat, 25 May 2013 13:02:18 GMT

side to side vpn you mean?

Re: NAT exclude

cryptochrome — Sat, 25 May 2013 13:29:23 GMT

yes.

well actually.... basically I want to know if I can make exclusions to a NAT rule. If not, I think the loopback interface might be the solution for everything

Re: NAT exclude

Retired Member — Sat, 25 May 2013 13:34:16 GMT

I think you can use loopback for these exceptios.

I just tried for GP before but not for any other service.

Logic is the same so it should work.