topic Re: Virtual IP in General Topics

Virtual IP

mbs.admin — Sat, 10 Aug 2013 02:28:38 GMT

We have a scenario wherein we should create a virtual private IP in Palo Alto and that virtual IP will connect to a public IP. For example:

PA LAN IP: 192.168.1.1

PA PUBLIC IP: 9.9.9.9

Firewall Virtual IP: 192.168.1.254

Public IP: 1.2.3.4

Users will connect to 192.168.1.254 for ftp and 192.168.1.254 will connect to 1.2.3.4, which is a ftp server hosted in the internet. Is this possible? I tried using NAT but it did not work

Thanks.

Re: Virtual IP

Retired Member — Sat, 10 Aug 2013 09:38:29 GMT

you can try to write a NAT rule

LAN to LAN dest. ip 192.168.1.254/service ftp port with both source NAT 192.168.1.1 and Destination NAT 1.2.3.4

what is your real purpose to do that ? just hide public ftp ?

Re: Virtual IP

mbs.admin — Sat, 10 Aug 2013 12:45:42 GMT

Hi panos

Thanks for the reply. I did your suggestion but it's not working. I see at the traffic log that users connecting to 192.168.1.254 are translated to 9.9.9.9 but application is incomplete. The users don't have internet access. As a workaround, users are connecting to the virtual IP and the firewall will connect to the public ftp. This works with their previous firewall and their hoping we can do the same with Palo Alto.

Thanks.

Re: Virtual IP

Retired Member — Sat, 10 Aug 2013 13:07:51 GMT

if you see incomplete problem is different

This worked for me just ftp to virtual ip(192.168.111.10) nothing else no internet allowed

Re: Virtual IP

mbutt — Sun, 11 Aug 2013 00:41:53 GMT

If you have an ip address in the NAT rule that is not configured on the PA firewall then you need to configure a fake route for it work.

Below is the document that explains on how to do that

Destination NAT for a Network not Connected to the Firewall

Moreover if you are trying to do a U-turn NAT following doc explains with examples on to do that page 22.

https://live.paloaltonetworks.com/docs/DOC-1517

Moreover the above document give good understanding of NAT on the PA firewalls.

Please let us know if this helps.

Thanks

Numan