Help required to convert Cisco ASA NAT rule onto Palo Alto

cancel
Showing results for 
Search instead for 
Did you mean: 

Help required to convert Cisco ASA NAT rule onto Palo Alto

L4 Transporter

Hi Guys,

I am not expert in reading or understanding the Cisco ASA NAT rules and I have just started to feel comfortable with Palo Alto except for NAT rules.  Can someone please guide me through on how to go around configuring the following Cisco ASA NAT rule onto the Palo Alto?

I have just taken a couple of rules to convert.  Based on this, I would get the rest done on my own.

Following are the CISCO ASA NAT RULEs:

Rule 1 # access-list inside_nat0_outbound extended permit ip 10.1.2.0 255.255.255.0 10.1.250.128 255.255.255.128

Rule 2 # access-list inside_nat0_outbound extended permit ip EH_Staff_Network 255.255.255.0 10.1.250.128 255.255.255.128

I know the exact rule cannot be expalined, but an overview on how to re-configure the above rules will be very helpful.

Many Thanks in Advance.

Regards,

Kal

16 REPLIES 16

The www.securlabs.net website is not affiliated with, endorsed or supported by Palo Alto Networks. Use of the site is at your own discretion and risk.

L4 Transporter

James,

This installation has been a disaster for me.  Just could not understand how the Cisco ASA works in terms of VPN and NAT.  Hence, i had to pull back and leave the network as it is.  Smiley Sad

L4 Transporter

Issues I had faced were:

a.       We could access the Internet ONLY IF the Proxy settings were enabled on the web-browser ( The settings for proxy were; IP address set to 10.1.30.8 on port 8080).  If the proxy settings were disabled, we COULD NOT access the Internet.  This meant, all those who were using the proxy settings were able to browse to the internet and administrators who do not use the Proxy, but go through their Cisco ASA were unable to browse to the internet.

b.      We were UNABLE to gain access to servers in DMZ ( FYI, on a couple of occasions, we could access the DMZ, strange..!!!).

c.       We could NOT send emails, but COULD receive emails.

I am sorry to hear that.

If you would like some assistance, you can contact me over PM.

Have you tried working with your SE to iron out the rules?  Ours has been more than helpful with all of our deployments.

Prince,

I will be doing it again during this week.  Hopefully it goes well. 

Hello,

We have a very good article that goes over the different types of NAT in detail with screenshots of what the security policy and the NAT policy should look like for each:

If you still have trouble, you could contact your SE or support.

Thanks,

Jason

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!