topic Re: NAT and OSPF in General Topics

NAT and OSPF

Alex_Samad — Wed, 10 May 2017 08:47:45 GMT

I have a PA-3060 (A-A).

I have a NAT lests say

1.1.1.1: 443 -> 192.168.10.10:10000

now the PA is part of an OSPF network, how to I publish out the address 1.1.1.1

I was thinking of adding 1.1.1.1 to a loopback and adding to a virtual router and then adding the interface to OSPF.

I read that I need a policy for src address: port -> 192.168.10.10:10000 as the policy happens after the NAT. But now that I have the ip address on the loopback, I am seeing failed packets on 1.1.1.1 address so do I need both ?

Thanks

Re: NAT and OSPF

Alex_Samad — Thu, 11 May 2017 02:16:17 GMT

Okay for any one coming to this later.

fristly, NAT doesn't happen first !

So added ip address to a loopback (on both devices HA A/A)

add interface to OSPF setup

now the bit that wasn't working - you have to set the management port profile ... even though the packets are going to end up else where, its a loop back and you have to allow whats needs, so for me it was http and https..

What you would do if it was something else I am not sure !!

Re: NAT and OSPF

Alex_Samad — Fri, 12 May 2017 00:14:42 GMT

Added a static route and added in redistribution of static into ospf

Re: NAT and OSPF

jsalmans — Fri, 12 May 2017 13:40:45 GMT

If your question is how to advertise your NAT pool or single address out OSPF I believe we just created OSPF Export Rules and advertised them as ext-1.

We've got two virtual routers, one for the inside networks and one for the Internet side. Each of those does OSPF out to their respective networks (Internet side OSPF just goes to an edge router) and iBGP propogates whatever routes we want between the two. The export rules that contain our NAT ranges are on the Internet side VR.

I asked our proffesional services steam if this was the correct way to implement it and they said that would probably be how they would have done it. The only thing I don't like with our current setup is that it is advertising ALL of our public IPs this way which means even IPs that aren't being used for NAT have a route from the firewall. I think a solution would be to just create more specific Export Rules to contain only what we're using for NAT and then have a NULL route for the entire range on our edge router. That way, any traffic destined for an IP not being used for NAT currently just dies at the edge instead of having to hit the firewall.