External Untrusted Site LDAP via NAT to Trusted Windows AD server

[catrock]

Hello.  I have reviewed a number of PA article and Live Video's and still am not sure my NAT and Security policy are functioning.

PA-220.

Below is the monitoring log I am seeing.  I expect to see 389/LDAP to complete and show some NAT details - which I am not.

The source (External site) will be sending the LDAP requests from 52.38.125.245 or 54.184.34.4.

Attached are pictures of my NAT and security policy: The External LDAP requestor is the external site (address group).

Any hints on what or where to look next for troubleshooting is very much appreciated.

Thank you.

[SutareMayur]

@catrock,

You need to change destination zone to "Trust-L3" under NAT policy. You have mentioned as "Untrust-L3". And due to this traffic matching under 'intrazone' default rule. Try by making changes under NAT.

Hope it helps!

Mayur

[catrock · Accepted solution]

Thanks again for your help.

Turns out the NAT ZONE(s) I had configured were correct.  What I needed to do was remove the service I had defined in the NAT (set it to any).  The service is then allowed (defined) in the policy.

The LDAP coming in wasn't on a defined port (was dynamic)..

Works now 🙂