Policies security and NAT are bidireccional???

[soporteseguridad]

If there is a security policy applied from just "untrust to trust" permitting SSH traffic .. this rule will be bidirectional??? or i would need to create other rule from trus to trust permitting SSH???

Its the same with NAT rules???

thanks

[soporteseguridad]

or i would need to create other rule from untrust to trust permitting SSH???

[kprakash]

Good Morning,

From what I understand, you wanna  create a security rule from Untrust to Trust, so that people from the internet can access a server that is behind the firewall on the trust zone. If the users from the internet initiate a new ssh session to the firewall, then the firewall receives a SYN packet from the untrust to the trust zone. We need not write a new policy for the SYN-ACK from the trust to untrust to go out, and the firewall will match any the server to client traffic on ssh to the same "untrust to trust" rule that you created. So it depends upon who is initiating the session. If someone is initiating a new ssh connection from the trust zone, we would then require a policy from "trust to untrust" allowing ssh.

Bear in mind that when we have an inbound connection from the internet ( untrust to trust), the NAT rules are written slightly differently, and you may wanna refer to the destination NAT configuration as mentioned under page 15 of  the NAT tech note,

https://live.paloaltonetworks.com/docs/DOC-1517

BR,

Karthik

[Gregoux]

first scenario

when

a client have to established session on a server with a source NAT to the aim of masking  the ip of the client or for routing purpose. you just need a static NAT without bidirectionnal option.

second scenario

if you create a static nat with the bidirectional option  and with a destination address declared.

you have the same behaviour, but its like you create another nat rule but a destination nat rule that allow the server to initiate a connection on your client of the first scenario

that make sens?