I've tried setting up a subnet on our local network for wireless BYOD purposes and our aim is to have phones/pads connect only on this subnet (10.84.0.0/16). An ACL on our layer 3 core switch prevents this subnet from communicating with other 10.x.x.x segments directly, where our other users and servers are set up.
We want to apply our filtering rules to internet access (Time of Day, URL/content, AV etc) and also force them to access our hosts/content as if they were on the untrusted side of the firewall. (basically make them 'go outside, then come back in' through the firewall)
I've set up DHCP to give an external resolver for DNS lookup, and I've added a dynamic NAT address rule for that subnet with an address on the untrusted interface, hoping that the BYOD subnet will route out through our internet addresses and back in.
What I see in the logs is 'incomplete' traffic to the NATed destination address, from an unNATed source address. ( zones: trust-> trust)
If I need to, I can set up another ethernet interface and zone, etc.
I'm wondering if there's a simple/elegant way to get this 'outside/inside' setup to work? (We're also running this HA - Active/Active so whatever gets implemented will need to live happily on 2 devices: 2x PA2050, PANOSv.4.1.7)
Thanks in advance.
I did this so that our Ipads could get from their zone into the trust zone for activesync. Seems to me that using an external DNS might make it more difficult for more than a couple of servers. You can probably take the below and substitute in some ranges (i.e. the translated address can be a range). Of source you will need some security rules as well. Hope this helps.
source zone-ipad zone
dest address-a public IP of PA
type: Dynamic IP and port
address type: Interface address
interface: ethernet1/1 (interface of untrust zone)
IP address: A public facing IP different than the one above
translated address: Internal address of exchange server
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!