static nat + intrazone u-turn and interzone u-turn at same time

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

static nat + intrazone u-turn and interzone u-turn at same time

L2 Linker

I'm currently having problems on PAN OS 5.0.1 replicating a standard Screenos MIP configuration. Whereby static nat and interzone/intrazone u-turn nat are all active at the same time.

We have multiple zones (5) all of the hosts inside each need to be able to access DMZ servers by their NATd public ip address (multiple dmz zones). Also unfortunately hosts inside the DMZ's sometimes want to talk back to themselves using their public ip address instead of their private.. Terrible I know..

Also when the DMZ servers talk to the internet they need to appear as their static natd public address.. when they talk to the internal (inside) network they appear as their standard private address..

Attached is a screenshot of the NAT configuration for 1 DMZ server..

The intrazone and interzone u-turn nating only work when the SNAT (static source translation) is not enabled..

Any thoughts?

I know we could be using split-dns.. and also this current design is begging for a re-architecture.. but we currently need to maintain status quo functionality for this firewall transition..

1 REPLY 1

L6 Presenter

So what is the problem with enable SNAT ?

Could you please clarify what is not working ? Thanks

  • 2232 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!