I need to configure my PAN to allow LDAP and port 636 inbound from 10 specific IP addresses for authentication with a software company. Can't figure out how to do this correctly.
Solved! Go to Solution.
You can write a Destination NAT with the source IP address as the 10 IP adresses, the source zone as "untrust", the destination address with the public IP address of the ldap server, the destination zone as "untrust", service as 636 under the original packet section. Under the translated packet section, click on the check box of the "destination address translation" and give the private IP address of the ldap server.
Write a corresponding security rule with the source IP address as these 10 IP addresses, the source zone as "untrust", the destination IP address as the "public IP address of the server", the destination zone as "trust ( or DMZ, where the server is located), application = LDAP, service =any, and action= allow.
You could create address objects for these IP addresses, and use these address objects under the NAT and the security rules,if you want to identify the users based on a string / identity. You also have an option of adding these IP addresses on the fly when creating the new rules.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!