topic Re: DMZ Web Server Access Setup PT2 in General Topics

DMZ Web Server Access Setup PT2

cpatte7372 — Mon, 16 May 2016 10:54:42 GMT

Hello Community,

Can someone please let me know if Palo Alto have any documentation examples of setting up access to a webserver from the Internet that resides in a DMZ?

Thank you

Carlton

Re: DMZ Web Server Access Setup PT2

rmonvon — Mon, 16 May 2016 13:33:58 GMT

Hi...I assume your case is to allow Internet users to connect to your web server in the DMZ and the server will be assigned a private IP address. Please checkout the section 'Destination NAT' in this NAT document which has an example of the NAT & security rules:

https://live.paloaltonetworks.com/t5/Documentation-Articles/Understanding-PAN-OS-NAT/ta-p/60965

The basic config is to define the inbound dest NAT rule to translate the public IP to the private IP, and the security policy rule to allow the specific app/traffic to the web server. Optionally, you can also define DoS protection rule to protect the server from possible DoS attacks.

Thanks,

Re: DMZ Web Server Access Setup PT2

cpatte7372 — Mon, 16 May 2016 14:27:43 GMT

BITHEAD,

This is great.

Is there any other similar documents showing examples of how to configure L3 - Sub-interfaces?

Regards

Carlton

Re: DMZ Web Server Access Setup PT2

rmonvon — Mon, 16 May 2016 17:56:45 GMT

yes, a quick search on 'l3 sub' has several useful results. Here's one:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-Tagged-Sub-Interfaces/ta-p/58712

Re: DMZ Web Server Access Setup PT2

tsrivastav — Mon, 16 May 2016 21:35:03 GMT

Re: DMZ Web Server Access Setup PT2

tsrivastav — Mon, 16 May 2016 21:41:40 GMT

If you are thinking why mentioned Public IP in the security policy not the private

---We mention always the ip based on the original / prenatted ip packet.

I found one old still the best documnet for understanding nat please follow the below link to check the same hope this may help

https://live.paloaltonetworks.com/t5/Documentation-Articles/Understanding-PAN-OS-NAT/ta-p/60965