topic Re: DMZ to inside LAN in General Topics

DMZ to inside LAN

Andy_Hoeller — Mon, 20 Mar 2017 16:26:35 GMT

I know you need a security policy to go from dmz to Lan but do you need a nat statement. On all the Palo Alto documents that I have seen no nat rule is used. If I am wrong could some one send me a link.

Thank you

Re: DMZ to inside LAN

TranceforLife — Mon, 20 Mar 2017 17:21:48 GMT

Hi,

It all depends if you want to "hide" the source ip or/and if you coming from the private ip address to the public or vice versa. from DMZ to LAN (assuming you do have a private ip address range), if you want to "hide" the DMZ server source ip address then you can NATed to the PA LAN interface so all request will appear for the LAN users as PA source ip. NAT is not a requirement between the rfc 1918 ip addresses but it is between the public ip as private ip are not allowed on Internet.

Re: DMZ to inside LAN

BPry — Mon, 20 Mar 2017 17:31:13 GMT

Can you explain what you are trying to do a little bit more, and what your current infrastructure looks like. You may be thinking about a u-turn NAT or hairpinning but without knowing what your setup looks like we can't give you an answer for your enviroment.

Generally the respective zones would just need security policies put into place to allow the traffic.

Re: DMZ to inside LAN

bradk14 — Mon, 20 Mar 2017 18:19:28 GMT

no, DMZ <-> Trust should not require a NAT.

As long as the routing is all square, you won't need anything beyond the security policy. With or without the policy in place, the traffic logs should confirm that.

Re: DMZ to inside LAN

Andy_Hoeller — Mon, 20 Mar 2017 18:57:24 GMT

Thank you

Re: DMZ to inside LAN

pulukas — Tue, 21 Mar 2017 00:00:18 GMT

As everyone has mentioned, if the hosts are communicating on their connected internal addresses all is good.

But I suspect you may be referring the the case where internal hosts get DNS entries with the external address of the servers in your DMZ. Then you do need to use what is called "U turn" NAT for the connections to work.

See this documentation.

https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Configure-U-Turn-NAT/ta-p/65081

Re: DMZ to inside LAN

Andy_Hoeller — Tue, 28 Mar 2017 16:40:37 GMT

thank you