topic PA-500 destination NAT not working on PAN-OS 7.0.3 in General Topics

PA-500 destination NAT not working on PAN-OS 7.0.3

Huddlebuy — Thu, 26 Nov 2015 13:55:07 GMT

Hi guys,

I have a Zabbix monitoring server on an external IP/network which is listening on port 10060. I have a zabbix agent installed on my internal windows server that is also listening on port 10060. The server will make requests to the agent to query its status.

To allow the Zabbix Server access to the internal network, I have setup destination nat translation and also added a firewall policy to allow traffic for that given IP/port. It 'should' work, but it doesn't. The internal server works as expected, I can telnet into 10060 but via the external IP, it just times out. Routes are setup fine and I can ping the windows server through the firewall.

Here is an image with the config for further clarity: http://s29.postimg.org/ta90zymjp/PAN.png

Please advice.

Re: PA-500 destination NAT not working on PAN-OS 7.0.3

iweltag — Thu, 26 Nov 2015 14:07:45 GMT

for testing purpose - i would try (Application: ANY and Service: ANY) in the security rule.

Re: PA-500 destination NAT not working on PAN-OS 7.0.3

Raido_Rattameister — Thu, 26 Nov 2015 14:22:45 GMT

Do you have single public ip or range?

If range try to configure bi-directional snat so that traffic would use same public ip if it is initiated from inside or outside.

Even better - check your traffic log first.

What app is identified?

Is it incomplete?