topic Re: Web server publishing error in General Topics

Web server publishing error

SPB99RO — Fri, 27 Apr 2018 13:54:31 GMT

Hi!

Help, please, with an Internal Web server publication.

I have a PaloAltor PA-200, PanOS 7.0.19.

I have ext. Internet on Eth1/1 (L3-Untrust zone) and LAN on Eth1/2 (L3-Trust zone). In my LAN I have a Server with Web publication (WebServer), which should be accessd from outside (Internet).

I`m trying to publish it. But got an error: Mismatch of destination address translation range between original address and translated address

Could someone, please, help with fixing th NAT and policy.

Re: Web server publishing error

OtakarKlier — Fri, 27 Apr 2018 13:58:16 GMT

Hello,

The destination zone in your screen shot needs to be the same zone that the web server resides in.

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/networking/nat/nat-configuration-examples/source-and-destination-nat-example

Hope that helps.

Re: Web server publishing error

SPB99RO — Fri, 27 Apr 2018 14:06:27 GMT

Thanks for response!

Trying to change zone, but got same error. Maybe you could suggest anything else?

Re: Web server publishing error

OtakarKlier — Fri, 27 Apr 2018 14:08:13 GMT

Also the destination address should be the IP of the webserver.

Re: Web server publishing error

OtakarKlier — Fri, 27 Apr 2018 14:16:21 GMT

Sorry menat the translated address. However here is one of my nat rules. Its a bi-directional rules, all that means that incoming traffic and outgoing traffic use the same external IP address.

Just as a personal preference I use NAT rules to just translate and use the security policies to dictate which services are allowed.

Re: Web server publishing error

SPB99RO — Fri, 27 Apr 2018 14:31:47 GMT

Thanks!

Trying to change main NAT, but unsuccessfully. Any ideas?

Re: Web server publishing error

OtakarKlier — Fri, 27 Apr 2018 14:49:57 GMT

What IP does your LAN object translate to? It should just be the webservers address.

Re: Web server publishing error

SPB99RO — Fri, 27 Apr 2018 14:55:06 GMT

LAN - 10.154.10.1/16

WebServer - 10.154.10.7

Re: Web server publishing error

OtakarKlier — Fri, 27 Apr 2018 14:57:21 GMT

Hello,

Put the Webserver address into your NAT rule.

Then it should work.

Re: Web server publishing error

SPB99RO — Fri, 27 Apr 2018 15:22:54 GMT

Hi!

Tried to change it, but lost access from LAN to Internet. Same time couldn`t connect the WebServer from outside.

Maybe there is another way to do it?

Re: Web server publishing error

Harshit — Fri, 27 Apr 2018 16:04:20 GMT

if i am assuming correct,

you are using one public ip and you are planing to use port 80 for webserver.

To set this up i would set up two different Nat statements, one for outbound only, that will translate your internal network to public ip, it would look something like this:

for outbound Nat:

security rule :

source ip : your internal ip

destination ip: any

source zone: trust

destination zone :untrust

service : http

Nat policy:

source ip : your lan ip

source zone: internal

detination ip : any

destination zone: untrust

source Nat to untrust interface ip

for inbound web server:

security rule :

source ip : any

destination ip: <your public ip>

source zone: untrust

destination zone :trust

service: http

Nat policy:

source ip : any

source zone: untrust

detination ip : your public ip

destination zone: untrust

destination nat : internal web server ip

~HTH

Re: Web server publishing error

SPB99RO — Fri, 27 Apr 2018 16:25:16 GMT

Thanks!

I`m trying to change it, but have a next mistake again. Maybe I mistaked somewhere?

Re: Web server publishing error

Harshit — Fri, 27 Apr 2018 16:41:57 GMT

okay, that's good.

make the following changes:

in Webpub:

1) make sure "Internet" is your public ip.

in Webout:

1) in source translate put your public ip and remove destination translation entry

~HTH

Re: Web server publishing error

SPB99RO — Fri, 27 Apr 2018 17:13:08 GMT

Thanks a lot to all for help!!!

For me working like this:

Re: Web server publishing error

Harshit — Fri, 27 Apr 2018 18:32:45 GMT

Glad i could help,

Please accept post as a solution if it helped.

~Harry