Isolate and NAT a segment for BYOD

Reply
Highlighted
L1 Bithead

Isolate and NAT a segment for BYOD

I've tried setting up a subnet on our local network for wireless BYOD purposes and our aim is to have phones/pads connect only on this subnet (10.84.0.0/16). An ACL on our layer 3 core switch prevents this subnet from communicating with other 10.x.x.x segments directly, where our other users and servers are set up.

We want to apply our filtering rules to internet access (Time of Day, URL/content, AV etc) and also force them to access our hosts/content as if they were on the untrusted side of the firewall. (basically make them 'go outside, then come back in' through the firewall)

I've set up DHCP to give an external resolver for DNS lookup, and I've added a dynamic NAT address rule for that subnet with an address on the untrusted interface, hoping that the BYOD subnet will route out through our internet addresses and back in.

What I see in the logs is 'incomplete' traffic to the NATed destination address, from an unNATed source address. ( zones: trust-> trust)

If I need to, I can set up another ethernet interface and zone, etc.

I'm wondering if there's a simple/elegant way to get this 'outside/inside' setup to work? (We're also running this HA - Active/Active so whatever gets implemented will need to live happily on 2 devices: 2x PA2050, PANOSv.4.1.7)

Thanks in advance.

Simon.

Highlighted
L4 Transporter

Re: Isolate and NAT a segment for BYOD

I did this so that our Ipads could get from their zone into the trust zone for activesync.  Seems to me that using an external DNS might make it more difficult for more than a couple of servers.  You can probably take the below and substitute in some ranges (i.e. the translated address can be a range).  Of source you will need some security rules as well. Hope this helps.

Bob

Nat rule:

Original packet:

source zone-ipad zone

dest zone-Untrust

dest address-a public IP of PA

Translated packet:

type:  Dynamic IP and port

address type:  Interface address

interface:  ethernet1/1 (interface of untrust zone)

IP address:  A public facing IP different than the one above

translated address:  Internal address of exchange server

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!