topic Re: What type of policy\rules do you need to access an internal licenses server from the internet in General Topics

What type of policy\rules do you need to access an internal licenses server from the internet

MemphisBrothers — Tue, 19 Nov 2013 02:43:43 GMT

I have an internal licenses server that users need to access from the internet, 10.1.3.21. The The external exposed ip is 216.55.55.10

The application on the users computer needs the following TCP ports open through the firewall so that client workstations are able to obtain a license from your license server system.

lmgrd.exe needs INCOMING TCP ports 27000 to 27009 and adskflex.exe needs 2080. What is the easiest way to address this?

We need a natting rule correct? What type.

Once I figure out the natting rule then I can created policies to allow application traffic on the necessary ports. Unless there is an exev simpler way to create it all. Ideas welcome

Re: What type of policy\rules do you need to access an internal licenses server from the internet

kadak — Tue, 19 Nov 2013 19:32:18 GMT

Hello MemphisBrothers

Considering that the license server is in the dmz-L3 zone and the traffic is coming from the untrust-L3 zone, here is how you would go about creating service objects, NAT rule and security rule

Service Objects (Source port kept empty):

Security Rule ( from untrust-L3 to dmz-L3):

NAT Rule ( from untrust-L3 to untrust-L3):

For future reference you refer the following document:

Understanding PAN-OS NAT (Page 19 -21 explains your scenario)

Hope the above configuration helps you.

Thanks and regards,

Kunal Adak

Re: What type of policy\rules do you need to access an internal licenses server from the internet

MemphisBrothers — Thu, 12 Dec 2013 01:20:01 GMT

Using this as a guide I was able to get what I needed to accomplish. Thanks a lot.

Re: What type of policy\rules do you need to access an internal licenses server from the internet

MemphisBrothers — Fri, 07 Mar 2014 01:01:31 GMT

An addendum to this. Turns out I only needed a rule for inbound traffic only.