Inbound NAT with Port Redirection for port 443 using a single outside interface IP ?

aarato — Sun, 02 Dec 2018 23:48:57 GMT

My ISP only provides a single ip address for the outside interface via DHCP.

I would like to forward port 443 to and internal host, but Palo keeps dropping the packets.

It seems as if the device management restriction is responsible for this, but I have removed that policy from the external interface so I am not sure why this is getting filtered. See console message below.

Inbound rules are set to ANY and SSH port forwarding inbound works without any problem.

Packet drops were inspected with packet filtering so I know the packets are dropped by Palo. Packets (rx,fw,dr) increasing while no tx.

admin@PA1(active)> show counter global filter packet-filter yes delta yes

Global counters:
Elapsed time since last sampling: 45.132 seconds

name value rate severity category aspect description
--------------------------------------------------------------------------------
pkt_sent_host 6 0 info packet pktproc Packets successfully transmitted to host interface
session_allocated 6 0 info session resource Sessions allocated
session_installed 6 0 info session resource Sessions installed
session_discard 6 0 info session resource Session set to discard by security policy check
flow_host_pkt_xmt 27 0 info flow mgmt Packets transmitted to control plane
flow_host_service_deny 6 0 drop flow mgmt Device management session denied
flow_host_vardata_rate_limit_ok 27 0 info flow mgmt Host vardata not sent: rate limit ok
flow_ip_cksm_sw_validation 6 0 info flow pktproc Packets for which IP checksum validation was done in software
ha_msg_sent 15 0 info ha system HA: messages sent
ha_session_setup_msg_sent 6 0 info ha pktproc HA: session setup messages sent
ha_session_update_msg_sent 9 0 info ha pktproc HA: session update messages sent
--------------------------------------------------------------------------------
Total counters shown: 11
--------------------------------------------------------------------------------

admin@PA1(active)>

Re: Inbound NAT with Port Redirection for port 443 using a single outside interface IP ?

Raido_Rattameister — Mon, 03 Dec 2018 15:50:39 GMT

Can you share screenshot of your NAT and Security policy?

Re: Inbound NAT with Port Redirection for port 443 using a single outside interface IP ?

aarato — Fri, 14 Dec 2018 03:13:40 GMT

Thanks for the reply unfortunately, I couldn't share the live environment, so I labbed it out and it works well in the lab environment. Thanks for the reply though.

topic Re: Inbound NAT with Port Redirection for port 443 using a single outside interface IP ? in General Topics

Inbound NAT with Port Redirection for port 443 using a single outside interface IP ?

Re: Inbound NAT with Port Redirection for port 443 using a single outside interface IP ?

Re: Inbound NAT with Port Redirection for port 443 using a single outside interface IP ?