NAT & port forward with dynamic IP on outside/untrust/Internet facing interface?

[O.Olsson]

So, I'd like to accomplish the following:

Client A on the Internet needs to access port 80 on server B. Server B resides behind the PA FW in the trust zone. The untrust zone consists of only one interface with a DHCP configured L3 interface. This IP is expected to change from time to time.

What I have configured is the following:

a) A NAT rule that specifies the destination address as a network object based on FQDN. The FQDN is in turn updated by dynDNS from another device.

b) A security policy to allow the port 80 traffic.

This is working. However, I'd like to remove this rather clunky "there I fixed it!" solution and instead use something along the lines of specifying the interface in the destination instead of an object. Alternatively, create an object that always mirrors the actual IP of an interface without the need of DNS/FQDN lookups and external mechanisms to keep that in sync.

And yes, I'm new to PanOS, but have (too) much experience from ASA FW's. Perhaps I'm till in that way of thinking, but to me it seems like the obvious solution would be to configure the interface as the destination, but that just doesn't seem to be possible in PanOS.

Anyway, looking forward to a better solution! 🙂 Any advice?

[OtakarKlier]

Hello,

I dont see anything wrong with using a FQDN object. Just have to make sure that the DHCP server is registering correctly with DNS and DNS is accessible and redundant. My biggest concern would be using port 80 and not something more secure.

Regards,