topic Re: behavior in multi-vsys with shared gateway and DNAT policies in General Topics

behavior in multi-vsys with shared gateway and DNAT policies

Carracido — Wed, 13 Jan 2021 20:17:18 GMT

Dear community,

We have a firewall with multi-vsys and the following scenario:

1 shared gateway and 1 public IP on external zone
1 virtual system and 1 private IP on internal zone

We configured DNAT to allow access to private IP from Internet following this article:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHxCAK

Observations to this configuration:

- Our "inbound web" security policy worked allowing only the internal IP and not including the public one.

# Question_1: is this because the vsys receives the traffic after DNAT from SG and only private IP is visible here?

- on the traffic log the destination IP shows the pre-NAT IP which is the public one with source zone = untrust_SG and destination zone = trust_vsys.

# Question_2: How it is possible that the traffic log is showing as source zone the untrust-SG if no security policy is used on the shared gateway?

It seems that this log shows transparently the trace from external zone of Shared gateway to the internal zone of vsys.

Thank you!

Re: behavior in multi-vsys with shared gateway and DNAT policies

reaper — Thu, 14 Jan 2021 10:22:09 GMT

hi @Carracido

- Our "inbound web" security policy worked allowing only the internal IP and not including the public one.
# Question_1: is this because the vsys receives the traffic after DNAT from SG and only private IP is visible here?

A1: yes, the SG performs NAT so the internal VSYS no longer needs to do the dnat lookup/security match

- on the traffic log the destination IP shows the pre-NAT IP which is the public one with source zone = untrust_SG and destination zone = trust_vsys.
# Question_2: How it is possible that the traffic log is showing as source zone the untrust-SG if no security policy is used on the shared gateway?
It seems that this log shows transparently the trace from external zone of Shared gateway to the internal zone of vsys.

A2: the shared gateway is not a fullblown vsys, it is 'shared' so some behavior is different from a regular vsys: it performs some rudimantary tasks, like NAT and routing, but packets are handed off to the actual sending/receiving vsys (because of tha lack of security policy)

Re: behavior in multi-vsys with shared gateway and DNAT policies

Carracido — Thu, 21 Jan 2021 19:58:18 GMT

Hi @reaper ,

Thank you for your answers. Do you know if there´s any KB link where that behavior is explained?

Kind Regards!

Re: behavior in multi-vsys with shared gateway and DNAT policies

MarcoBergonzoni — Mon, 28 Jun 2021 13:21:46 GMT

I have a strange behavior in the similar scenario.

We configured a destination nat with original port 10443 and traslated to port 443 on shared gateway.

In order to allow traffic to internal web server we opened port 10443 instead of 443 on security policy of internal virtual system.

Why I see traffic on port 443 of internal virtual system when the NAT is configured on shared gateway?

Best Regards

Marco