Converting config from Nortel Connectivty switch to PA200.
untrust - public ip - 22.214.171.124/28
trust:private ip - 10.10.10.0/24.
There is one to one mapping of few untrust ip to trust ips( to access trust ips from outside) and also few one to one mapping from dmz to trust.
When translating this to PA200.
I can do untrust to trust fine adding nat and security rules.
But when doing dmz to trust not sure about security polices and nat rules.
Will it be untrust to dmz(eg-126.96.36.199) -destination address translation ,translated address 10.10.10.100 in nat rule and untrust to trust(188.8.131.52) in security rule.
I think it will be like that yes. But it's a bit weird concept i haven't seen yet. Are there also some servers with public address in DMZ? Or are there only NAT-ed servers? If it's only NAT-ed servers in DMZ than you can easily skip configuring DMZ on seperate interface and just configure that segment on untrust interface.
Nothing to do with your original question: but NAT into LAN is a very poor design regarding security. So if you have a chance try to redisgn the network.
thanks for the info. But if you dont NAT in LAN how do u access LAN from untrust if u need to. Do u move them to dmz and just
have untrust to dmz access?
Servers accesible from internet should be in DMZ. They should have only necessary services/applications open towards LAN. So if a server is breached, attacker still has no access into LAN and other networks (or very limited).
In what cases would you need direct access from internet to LAN?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!