Cannot reach server at DMZ via Nat

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Cannot reach server at DMZ via Nat

L2 Linker

Hi 

NAT is setup at PA for outside users to reach DMZ server based on protocol
The topology is like the below:

SW1(f1/1) -------- (e1/1,DMZ)PA(Outside,e1/5)--------(f1/5)SW2

Interface config:

e1/1 10.100.255.1/24
f1/1 10.100.255.2/24 as inside Server

e1/5 44.33.22.1/24
f1/5 44.33.22.2/24 as outside Users


Please see below PA configurations for NAT and Security policy. SW2 can ping 44.33.22.1(PA), but cannot ping translated ip address 44.33.22.10. We can also see Hit count increase at Nat, but not change at Security after SW2 ping 44.33.22.10. Thank you

 

DavidyPalo_0-1640193938552.png

 

 

DavidyPalo_1-1640192264988.png

 

DavidyPalo_2-1640192562824.png

 

 

 

 

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hello,

In the Palo Alto you do need to configure the routing in the scenario you proposed. So lets take that and here is what will need to be configured:

PC1 = 192.168.1.5, 255.255.255.0, 192.168.1.1(Palo Alto interface VLAN10)

PC2 = 192.168.2.5, 255.255.255.0, 192.168.2.1(Palo Alto interface VLAN20)

Layer 2 interfaces

OtakarKlier_3-1640272995358.png

Layer3 vlan interfaces

OtakarKlier_6-1640273484265.png

 

Virtual Router static routing

OtakarKlier_4-1640273131112.png

Security policies

OtakarKlier_5-1640273184116.png

 

Now this is the most basic configuration without any protections in place. It should allow you to ping from on PC to another.

 

Regards,

 

View solution in original post

9 REPLIES 9

Cyber Elite
Cyber Elite

Hello,

Looks like your nat is incorrect, e.g. the zone. Its written as outside to outside. It should have the inside zone, DMZ as the destination zone. Unless its a bi-directional nat.

Cheers!

Cyber Elite
Cyber Elite

Hello,

What do the logs say? it should tell you if its allowed or denied.

Regards,

 

Cyber Elite
Cyber Elite

Hello,

Also do you have a NAT going outbound? From the DMZ server to the Internet?

Regards,

L2 Linker

log says nothing. Please see the below. I setup log, but not sure if it can work.

DavidyPalo_0-1640208584733.png

 

"Also do you have a NAT going outbound? From the DMZ server to the Internet? . . . ."

Do you mean routing? The server and user pc have default gateway pointing at the PA. In addition to this, the PA still need to send something out? but the user pc is at the same subnet as PA interface e1/1, and the server is at the same subnet as PA e1/2. 

PA still need routing? 

 

 

 

 

 

Cyber Elite
Cyber Elite

Hello,

I was looking at the screen shot above and I dont see a config for eth1/2. Also it you want the server to communicate out to the internet, it will need a NAT outbound. If the server and internal users are in different zones, you will need security policies to allow traffic from the users internal zone to the DNZ zone. If you want to do a hair-pin, e.g. the users get to the DNZ server via its public IP, you will need a u-turn NAT and policies for this.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEiCAK

 

Perhaps I should have asked first, can you explain the traffic flow? How are the users supposed to access the server in the DMZ zone?

Regards,

Cyber Elite
Cyber Elite

Hello,

Also yes the PAN needs to have routing configured in its 'virtual router'. Has this been accomplioshed?

Regards,

L2 Linker

"Also yes the PAN needs to have routing configured in its 'virtual router'. Has this been accomplioshed?. . . . "

In routing field, for example, R1( orPC1) --------- Router2-------R3(PC2), when we need PC1 ping PC2, what we need to do is to configure local ip address and default-gateway or default ip route at PC1/PC2. and we do NOT need to configure additional routing at Router2. Only thing we need to do at Router2 is to setup two interfaces toward PC1 and PC2 respectively.

 

I am not familiar with the firewall, but at this point, it should be similar with Router. PA should just setup virtual router in this case

Cyber Elite
Cyber Elite

Hello,

In the Palo Alto you do need to configure the routing in the scenario you proposed. So lets take that and here is what will need to be configured:

PC1 = 192.168.1.5, 255.255.255.0, 192.168.1.1(Palo Alto interface VLAN10)

PC2 = 192.168.2.5, 255.255.255.0, 192.168.2.1(Palo Alto interface VLAN20)

Layer 2 interfaces

OtakarKlier_3-1640272995358.png

Layer3 vlan interfaces

OtakarKlier_6-1640273484265.png

 

Virtual Router static routing

OtakarKlier_4-1640273131112.png

Security policies

OtakarKlier_5-1640273184116.png

 

Now this is the most basic configuration without any protections in place. It should allow you to ping from on PC to another.

 

Regards,

 

L2 Linker

Thank you!!

  • 1 accepted solution
  • 5259 Views
  • 9 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!