Inbound NAT with Port Redirection for port 443 using a single outside interface IP ?

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L1 Bithead

Inbound NAT with Port Redirection for port 443 using a single outside interface IP ?

My ISP only provides a single ip address for the outside interface via DHCP.

I would like to forward port 443 to and internal host, but Palo keeps dropping the packets.

 

It seems as if the device management restriction is responsible for this, but I have removed that policy from the external interface so I am not sure why this is getting filtered. See console message below.

Inbound rules are set to ANY and SSH port forwarding inbound works without any problem.

Packet drops were inspected with packet filtering so I know the packets are dropped by Palo. Packets (rx,fw,dr) increasing while no tx.

 

admin@PA1(active)> show counter global filter packet-filter yes delta yes

Global counters:
Elapsed time since last sampling: 45.132 seconds

name value rate severity category aspect description
--------------------------------------------------------------------------------
pkt_sent_host 6 0 info packet pktproc Packets successfully transmitted to host interface
session_allocated 6 0 info session resource Sessions allocated
session_installed 6 0 info session resource Sessions installed
session_discard 6 0 info session resource Session set to discard by security policy check
flow_host_pkt_xmt 27 0 info flow mgmt Packets transmitted to control plane
flow_host_service_deny 6 0 drop flow mgmt Device management session denied
flow_host_vardata_rate_limit_ok 27 0 info flow mgmt Host vardata not sent: rate limit ok
flow_ip_cksm_sw_validation 6 0 info flow pktproc Packets for which IP checksum validation was done in software
ha_msg_sent 15 0 info ha system HA: messages sent
ha_session_setup_msg_sent 6 0 info ha pktproc HA: session setup messages sent
ha_session_update_msg_sent 9 0 info ha pktproc HA: session update messages sent
--------------------------------------------------------------------------------
Total counters shown: 11
--------------------------------------------------------------------------------

admin@PA1(active)>

Highlighted
L7 Applicator

Can you share screenshot of your NAT and Security policy?

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Highlighted
L1 Bithead

Thanks for the reply unfortunately, I couldn't share the live environment, so I labbed it out and it works well in the lab environment. Thanks for the reply though. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!