DMZ, inside, outside - is it simple thing?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

DMZ, inside, outside - is it simple thing?

L1 Bithead

Hi there.

 

I have a PA-200.

Internal net is 192.168.0.0/24 eth1/2 , inside L3 interface  (default gw) -  192.168.0.254

One external ip address is using for outside inteface, eth1/1.

For connection to Internet I typically use pair inside-outside with:

1. NAT : dynamic-ip-and-port  to outside interface address nat-rule

2. Security policy "allow from inside to outside , any dest address"

Now, I need provide access for FTP-Server. I created DMZ interface eth1/3 - 172.16.0.254/24

FTP-Server is directly-connected to DMZ-port and has ip 172.16.0.1

For this scenario i created 

1. NAT : bi-directional between FTP-Server and Outside .

2. Security policy for Outside and DMZ.

What I can do as next step for provide connection between inside and DMZ?

I create security policy allow inside-dmz (to 172.16.0.0/24) and dmz-inside (to 192.168.0.0/24)

If i do ping 172.16.0.1 from 192.168.0.1 than i see that all packets are matching to first NAT-rule "inside to outside" and that is wrong way.

What is wrong in my steps? How I can exclude traffic from "default "NAT-rule. Althought I tryed create no-nat rule than it do not work.

Thank for help.

6 REPLIES 6

Community Team Member

Hi @mxe2fmk ,

 

Methinks you'll be needing U-turn NAT.

 

Check out the following links on the topic:

 

HOW TO CONFIGURE U-TURN NAT 

DOTW: U-TURN NAT ISSUE 

Video tutorial: U-turn NAT 

 

Hope it helps,

-Kiwi.

LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Cyber Elite
Cyber Elite

your default NAT rule must be wrong

my guess is that you didn't add zones properly and one or all zone fields contain an ANY

 

your nat rules should be

FROM internet TO internet DO destination translation to FTP-internal  (don't do bidirectional)

FROM lan & dmz TO internet DO dynamicIP/port sourcenat

 

this way your connection from 192.168 to 172.16 can never hit a NAT rule and you'll be good to go

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

L0 Member

Try the following:

- eth1/2 IP address 192.168.0.254/24
- eth1/3 IP address 172.16.0.254/24
- Create a service group object with all the ports for the FTP service. [svc-group-ftp]
- FTP server's IP 172.16.0.1/24 and gateway 172.16.0.254
- Security rule to allow desired traffic from inside to DMZ, and from DMZ to inside. This one you have already.
- Source NAT rule dynamic-ip-and-port from DMZ to outside eth1/1 to enable the FTP server to access the internet. Same as the one you have for inside zone but for DMZ. You can also keep the one you have and add the DMZ zone in the src zones.
- Destination NAT rule for outside traffic to your DMZ
src zone outside, dst zone outside, dst interface eth1/1, service [svc-group-ftp], src address any, dst address [your-public-ip], src transation none, dst transation static ip 172.16.0.1
- Security rule to allow outside traffic to DMZ FTP server
src zone outside, src address any, dst zone dmz, dst address [your-public-ip], application any, service [svc-group-ftp]

I found out that U-turn NAT is possible scenario for one-zone ( inside ), and isn't for using with inside-dmz pair.

 

Only one NAT rule

name: NATbase

src zone: inside

dst zone: outside

dest int: eth1/1

src addr: any

dst addr: any

service: any

src translation: dynamic-ip-port, eth1/1 , outside_ip 

Ok, I unerstand this example.

Could You please additional moment - what's about NAT rule "inside to outside"?

  • 6026 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!