PA Destination NAT

Nikko — Mon, 10 May 2021 18:29:36 GMT

I have a use-case that all subnets/VLANs should be able to access the server (192.168.4.4) via HTTP using the loopback IP address 192.168.6.2/32.

The PA firewall is the gateway for all the VLANs. I would like to confirm if this is possible? The source will be VLAN 5 or VLAN 10 and destination is VLAN 20's loopback IP 192.168.6.2/32 using HTTP service then the PA should redirect the traffic to VLAN 30's 192.168.4.4 address.

Thanks

Re: PA Destination NAT

aleksandar.astardzhiev — Tue, 11 May 2021 10:06:30 GMT

Hi @Nikko,

If I understand correctly what you are asking it is possible yes.

set rulebase nat rules Web-Server-Destination-NAT to loopback-zone
set rulebase nat rules Web-Server-Destination-NAT from [ vlan5-zone vlan10-zone] # or select any if
set rulebase nat rules Web-Server-Destination-NAT source any
set rulebase nat rules Web-Server-Destination-NAT destination loopback_192.168.6.2
set rulebase nat rules Web-Server-Destination-NAT service any
set rulebase nat rules Web-Server-Destination-NAT destination-translation translated-address server_192.168.4.4

In addition you need to create allow rule:

set rulebase security rules Access-to-Web-Server profile-setting group default
set rulebase security rules Access-to-Web-Server to [ server-zone ]
set rulebase security rules Access-to-Web-Server from [ vlan5-zone vlan10-zone]
set rulebase security rules Access-to-Web-Server source any
set rulebase security rules Access-to-Web-Server destination [ loopback_192.168.6.2 ]
set rulebase security rules Access-to-Web-Server application [ web-browsing ]
set rulebase security rules Access-to-Web-Server service application-default
set rulebase security rules Access-to-Web-Server action allow
set rulebase security rules Access-to-Web-Server log-setting default

You need to note couple of thinks:

- In the security rule you need specify the destination zone where your web server is located.

- In the security rule you need to specify the destination address of your loopback, aka the destination address before the NAT (users will use the loopback to access the server)

- In the NAT rule you need to specify the destination zone where your loopback interface is located. This is because the NAT is evaluated first and applied later. Which means that when the original packet (from user) hit the firewall, FW will use the original destination IP (in this case the loopback) to determine which is the destination zone

By the way - based on your network setup it is not necessary to have the IP as loopback on the FW to use it in NAT. Your devices only need to know to route 192.168.6.2 to the firewall (either with specific or default route)

Re: PA Destination NAT

reaper — Tue, 11 May 2021 10:14:39 GMT

hi @Nikko

yes, this is possible

the NAT rule will look like

topic Re: PA Destination NAT in General Topics

PA Destination NAT

Re: PA Destination NAT

Re: PA Destination NAT