GlobalProtect with NATet interface

[tormodhope]

I have a PA200, and is using eth1 for outside (internet) and eth2 for inside. I'm NATing from eth2 to eth1, as normal.

Now i want to have the management https address on the eth1 for several reasons.

At home its just for testing, but at my office i have PA200 between subnets that is duplicate, and not nessesary to route to.

When i use a management profile with access to ping and https on eth1, it wont't work.

I suspect the NAT rule has something to do with it. Cause when i set it up in my lab with no NAT, it works.

Any tips for me please?

[tormodhope]

I dont NAT anything from untrust to trust, i only have a overload nat from trust to untrust.

But it seams that it blocks everything, including ping, and https (thats why the GP wont connect).

[tormodhope]

Thanks! I'll try that later today.

I got ping working if i add a roule thats like this:

0.0.0.0/0 is just there to mas my origin public ip. The other rule is gone, as this is a test box at work.

[panos]

This rule is not a need but your other NAT rules are important.you have any other NAT rule with source zone any ?

or just 1 NAT rule from trust to untrust ?

[tormodhope]

Since im not home now, i cant confirm, but yes, i might have to rule setup with source any, and not pined down to my trust zones.

This is bad practice, i know. But is that the problem? I'll doublecheck when i get home.

The rule might be like this one, with source any.

[panos]

Yes it will be a problem as Phoenix said.

Try to change it with Trust and then test again.