topic Re: Route Public IP range through Shared Gateway in General Topics

Route Public IP range through Shared Gateway

SeboDeMacho — Mon, 03 Jul 2017 21:16:18 GMT

Hi guys,

I hope you can lend me a hand here.

Our ISP finally allocated us a Public /25 (aa.bb.cc.0/25) subnet which will be routed via the existing /30 (xx.yy.zz.2/30) internet link that we have.

We want to split it in half and use the Shared Gateway to route the traffic. The first half is for our webservers in VSYS1 . The other half is for office users who are in VSYS2, which is where we also want our Global Protect to terminate on.

(Before I start breaking things apart)

Q: Because we now have public IPs, should i continue to do all the NATs on the Shared Gteway, OR can I now use each VSYS to do the NAT'ing? We prefer the latter, but I'm not sure what else will break of what else to consider going down this path

Thanks!

Re: Route Public IP range through Shared Gateway

abjain — Wed, 05 Jul 2017 03:00:20 GMT

Hi,

I guess having NATs in Shared gateway will be more appropriate. If you configure NAT on vsys, there will be routing considerations on the Shared gateway vsys.

Here is an article for a bidirectional NAT involving shared gateway: https://live.paloaltonetworks.com/t5/Configuration-Articles/Configuring-Destination-NAT-using-a-VSYS-with-Shared-Gateway/ta-p/55187

Please see if it helps. You can approach TAC if need any specific help.

Best Regards,

Abhishek

Re: Route Public IP range through Shared Gateway

davanderson — Thu, 06 Jul 2017 20:02:18 GMT

I would second the NAT option. Setup a private subnet for each group of web servers (on their own zones) and then just NAT the traffic. I would create a static by-directional NAT on the PA FW and then setup inbound Security Rules to only allow the inbound traffic to the servers on their proper protocol.