Firewall not advertising the public IP

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Firewall not advertising the public IP

L4 Transporter

Hello,

 

We want to allow traffic from outside to come inside our server however cannot see any traffic unless loopback is used. This server is behind DMZ. We can solve the public IP address of the server when we go to www.whatismyip.com
 
Traceroute stops at 13th hop before we added loopback for the public IP.
 
We are using Source NAT like below:
 
In the Original Packet tab: Source Zone=DMZ, Destination Zone=WAN, Destination Interface=any, Service=any, Source Address=Local IP address of DMZ, Destination Address=any.
 
In the Translated Packet tab: Under Source Address Translation, Translation Type=Static IP, Translated Address=Public IP address of server, check Bi-directional.
 
We are using security policy as below:
 
Select Source Zone=Outside/WAN, Source Address=any, Destination Zone=DMZ, Destination Address=Public Address of the server, Application=ssl, Service=application-default, URL category=any, Action=allow.
 
Is there a solution wherein the NATing works without adding loopback or is it that loopbacks are mandatory for NATing?
 
Thanks in advance.
1 accepted solution

Accepted Solutions

the firewall needs to determine to which interface the IP address belongs for it to be able to send out proxy arp (else it could flood out all interfaces). therefore you should add the subnet to the external interface (or use individual loopbacks)

 

if you don't want to add the subnet or use loopbacks, you can create static ARP entries on the upstream router that point to your firewall interface for the desired IPs also

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

View solution in original post

4 REPLIES 4

Cyber Elite
Cyber Elite

Is the public IP address you used in the translation part of the subnet that's configured on the WAN interface ?

If you add the subnet to the external interface, this will simplify proxy-arp broadcasts.  Else, a loopback interface in the wan zone will do the trick

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Hi Reaper,

 

No, the public IP address is not part of the WAN interface subnet. We have already added the loopback in the WAN zone and it works. Ques is: is there a solution wherein the NATing works without adding loopback or is it that loopbacks are mandatory for NATing?

 

1.png2.png

 

the firewall needs to determine to which interface the IP address belongs for it to be able to send out proxy arp (else it could flood out all interfaces). therefore you should add the subnet to the external interface (or use individual loopbacks)

 

if you don't want to add the subnet or use loopbacks, you can create static ARP entries on the upstream router that point to your firewall interface for the desired IPs also

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

I just feel expertise in your responses @reaper

  • 1 accepted solution
  • 2604 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!