NAT Configuration to access Remote Desktop

[feelgood]

Hi,

We need to configure an input rule to authorize an public IP address to access at one of our virtual machine on our subnet.

Concretely, I need to authorize public IP address 195.193.194.195 access directly to our virtual machine with the private IP 192.168.1.1 on the port 3389 (Remote Desktop) only via our public IP address (82.83.84.85).

I configured a NAT rule but it didn't work. May be I doing something wrong ?

Can you help us about this topic ?

Thank you for your help.

[Abdul_Razaq]

Hi @feelgood ,

Hope you have configured the NAT and security rule properly. refer below doc for help.

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/networking/nat/nat-configuration-examples/...

[feelgood]

Hi @Abdul_Razaq,

Thank you for your answer, I go test that.

[BPry]

@feelgood,

While this certainly works I would question why you wouldn't simply give whoever's needs access to this device access through the built in GlobalProtect VPN solution. 

You are still exposing this desktop to the outside world. You might be limiting it via a security policy but the NAT statement is still there. To avoid issues due to a misconfiguration I would recommend against your current approach. 

[feelgood]

@BPry 

We have already GlobalProtect configured on our PanOS but it's for our users. This NAT configuration is for a partner who needs to access an environnement via our public IP address.

We don't want grant access at this partner on our VPN access because it's not partitionned correctly at this time.

So, the only solution I founded it's this NAT rules restricted on the IP address of this partner.