DMZ

[CGilbride]

We only have one public IP. Can I still set up a DMZ? If so, can someone point me to a good article on setting one up? I have found several but nothing that specifies if it is okay to set up using a single IP.

[TomYoung]

Hi @CGilbride ,

It is definitely possible to setup a DMZ with 1 public IP address.  A DMZ is recommended for all inbound traffic.

You would create a private subnet in the DMZ and use NAT to map the 1 public IP to the private IP addresses.  You could map different services (e.g., tcp/25, tcp/80, etc.) to different DMZ IP addresses.  You could also use other options in the rule.

Thanks,

Tom

[CGilbride]

@TomYoung, thank you. I think I found an article that will help. It looks like I would just add my public IP to the Destination Address field in the security policy I create. I'm new to Palo Alto, and normally deal with internal network infrastructure, so setting up DMZs is not my specialty, working on adding to my skill set. 

[OtakarKlier]

Hello,

Any protected subnet is technically a DMZ. Do you have services that are exposed to the internet?

Regards,

[CGilbride]

Hello @OtakarKlier, we do not. 

[reaper · Accepted solution]

here's an example NAT rule for a DMZ hosted webserver

In the original packet, you need to set untrust as source AND destination, this is because the original destination IP belongs to the external interface and the source IP originates from the internet. both of these zones are determined by doing a route lookup 

if you set a service (in this case https:443) only that port is translated, leaving you with all the other destination ports untranslated and free for additional rules that point to different destinations (smtp, ftp,...)

in the Translated Packet, we set the destination server's private IP so NAT can be applied, and you can also change the final destination port, in case the server is running a service on a different port from the default (ports can both be changed pre- and post NAT e.g. 4443 becomes 443 or 443 becomes 8443 etc. 

hope this helps

[OtakarKlier]

Hello,

Since you are not hosting any services that the people on the internet need to connect to, then all you need to do is create a security zone and vlan on the PAN. From there create the access policies as normal. This is now your protected vlan/DMZ. Also make sure you have a DENY ALL policy so its all allowed by exception.

Hope that makes sense.

[CGilbride]

Excellent!! thanks for the help.

[CGilbride]

Yes, I will test this out. Thanks for the excellent support!