Cannot reach server at DMZ via Nat

[DavidyPalo]

Hi 

NAT is setup at PA for outside users to reach DMZ server based on protocol
The topology is like the below:

SW1(f1/1) -------- (e1/1,DMZ)PA(Outside,e1/5)--------(f1/5)SW2

Interface config:

e1/1 10.100.255.1/24
f1/1 10.100.255.2/24 as inside Server

e1/5 44.33.22.1/24
f1/5 44.33.22.2/24 as outside Users

Please see below PA configurations for NAT and Security policy. SW2 can ping 44.33.22.1(PA), but cannot ping translated ip address 44.33.22.10. We can also see Hit count increase at Nat, but not change at Security after SW2 ping 44.33.22.10. Thank you

[OtakarKlier]

Hello,

Looks like your nat is incorrect, e.g. the zone. Its written as outside to outside. It should have the inside zone, DMZ as the destination zone. Unless its a bi-directional nat.

Cheers!

[OtakarKlier]

Hello,

What do the logs say? it should tell you if its allowed or denied.

Regards,

[OtakarKlier]

Hello,

Also do you have a NAT going outbound? From the DMZ server to the Internet?

Regards,

[DavidyPalo]

log says nothing. Please see the below. I setup log, but not sure if it can work.

"Also do you have a NAT going outbound? From the DMZ server to the Internet? . . . ."

Do you mean routing? The server and user pc have default gateway pointing at the PA. In addition to this, the PA still need to send something out? but the user pc is at the same subnet as PA interface e1/1, and the server is at the same subnet as PA e1/2. 

PA still need routing? 

[OtakarKlier]

Hello,

I was looking at the screen shot above and I dont see a config for eth1/2. Also it you want the server to communicate out to the internet, it will need a NAT outbound. If the server and internal users are in different zones, you will need security policies to allow traffic from the users internal zone to the DNZ zone. If you want to do a hair-pin, e.g. the users get to the DNZ server via its public IP, you will need a u-turn NAT and policies for this.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEiCAK

Perhaps I should have asked first, can you explain the traffic flow? How are the users supposed to access the server in the DMZ zone?

Regards,

[OtakarKlier]

Hello,

Also yes the PAN needs to have routing configured in its 'virtual router'. Has this been accomplioshed?

Regards,

[DavidyPalo]

"Also yes the PAN needs to have routing configured in its 'virtual router'. Has this been accomplioshed?. . . . "

In routing field, for example, R1( orPC1) --------- Router2-------R3(PC2), when we need PC1 ping PC2, what we need to do is to configure local ip address and default-gateway or default ip route at PC1/PC2. and we do NOT need to configure additional routing at Router2. Only thing we need to do at Router2 is to setup two interfaces toward PC1 and PC2 respectively.

I am not familiar with the firewall, but at this point, it should be similar with Router. PA should just setup virtual router in this case

[OtakarKlier · Accepted solution]

Hello,

In the Palo Alto you do need to configure the routing in the scenario you proposed. So lets take that and here is what will need to be configured:

PC1 = 192.168.1.5, 255.255.255.0, 192.168.1.1(Palo Alto interface VLAN10)

PC2 = 192.168.2.5, 255.255.255.0, 192.168.2.1(Palo Alto interface VLAN20)

Layer 2 interfaces

Layer3 vlan interfaces

Virtual Router static routing

Security policies

Now this is the most basic configuration without any protections in place. It should allow you to ping from on PC to another.

Regards,

[DavidyPalo]

Thank you!!