topic Re: External Untrusted Site LDAP via NAT to Trusted Windows AD server in General Topics

External Untrusted Site LDAP via NAT to Trusted Windows AD server

catrock — Mon, 01 Jun 2020 06:21:31 GMT

Hello. I have reviewed a number of PA article and Live Video's and still am not sure my NAT and Security policy are functioning.

PA-220.

Below is the monitoring log I am seeing. I expect to see 389/LDAP to complete and show some NAT details - which I am not.

The source (External site) will be sending the LDAP requests from 52.38.125.245 or 54.184.34.4.

Attached are pictures of my NAT and security policy: The External LDAP requestor is the external site (address group).

Any hints on what or where to look next for troubleshooting is very much appreciated.

Thank you.

Re: External Untrusted Site LDAP via NAT to Trusted Windows AD server

SutareMayur — Mon, 01 Jun 2020 09:19:36 GMT

@catrock,

You need to change destination zone to "Trust-L3" under NAT policy. You have mentioned as "Untrust-L3". And due to this traffic matching under 'intrazone' default rule. Try by making changes under NAT.

Hope it helps!

Mayur

Re: External Untrusted Site LDAP via NAT to Trusted Windows AD server

catrock — Tue, 02 Jun 2020 06:31:10 GMT

Thanks again for your help.

Turns out the NAT ZONE(s) I had configured were correct. What I needed to do was remove the service I had defined in the NAT (set it to any). The service is then allowed (defined) in the policy.

The LDAP coming in wasn't on a defined port (was dynamic)..

Works now 🙂