topic How to translate IP and port from trust to trust? in General Topics

How to translate IP and port from trust to trust?

davidgregg — Wed, 28 Feb 2018 18:52:18 GMT

My goal is to be able to reroute traffic from internal server 192.168.0.10 port 123 to other internal server 192.168.0.20 port 456

My understanding is that I do not need a u-turn nat rule since we're using internal IP addresses, however so far I've not found any rule configuration that successfully makes the translation when tested nor have I been able to find any examples of others doing similar.

Any help on this would be much appreciated.

Re: How to translate IP and port from trust to trust?

Remo — Wed, 28 Feb 2018 19:38:32 GMT

What is now the actual source (address and zone) and destination (address and destination) where you want to have a connection?

Re: How to translate IP and port from trust to trust?

davidgregg — Wed, 28 Feb 2018 19:45:40 GMT

For example client machine is 192.168.0.105

They currently access website at http://192.168.0.10

I'm setting up a server to act as failover on 192.168.0.20

I do not want user to have to manually change their bookmark etc. in case of failure, rather I have a script on 20 that monitors 10 and I would like that script to access the Palo Alto API to reroute traffic from 10 to 20

I already have the script and API figured out and working, however I haven't figured out how to setup the nat rule to forward traffic from 10 to 20 when client is internal

Re: How to translate IP and port from trust to trust?

davidgregg — Wed, 28 Feb 2018 19:49:57 GMT

Forgot to mention that client and both servers are all in trust zone

Re: How to translate IP and port from trust to trust?

Remo — Wed, 28 Feb 2018 20:15:42 GMT

Do you have a vwire between the clients and servers or are they all located in the same (I assume /24) subnet?

Re: How to translate IP and port from trust to trust?

davidgregg — Wed, 28 Feb 2018 20:18:54 GMT

They are in the same subnet

Re: How to translate IP and port from trust to trust?

Remo — Wed, 28 Feb 2018 20:32:43 GMT

So then the connection goes dirwctly and not over the firewall, which means in this configuration there is no way to configure a NAT rule on the firewall.

To be able to do that you would need an IP on the firewall. Then the firewall will be able to re-route the traffic with a NAT policy and in case of a failure you can change this NAT rule

Re: How to translate IP and port from trust to trust?

davidgregg — Wed, 28 Feb 2018 20:34:52 GMT

Gotcha. That makes sense. Thank you.