NAT exclude

[cryptochrome]

Hi,

is it possible to make exceptions/exclusions for a NAT rule? Think of this scenario:

• small PA-200 setup
• only one external/public IP address
• that IP address is used for a lot of incoming NAT
• the NAT rule basically forwards everything from the external IP to an internal host
• now I also want to enable GlobalProtect and incoming VPN connections on the external Interface

Problem:

Due to the "global NAT" rule mentioned above, incoming VPN/GP traffic would also be NATed to the internal Host.

Tried:

I tried to put a NAT rule above the forementioned global NAT rule with the same match criteria, adding service-https and disabling all destination translation options. I thought this would disable NAT for HTTPS. But it didn't work.

Ideas?

Thanks!

[panos · Accepted solution]

if your 443 port is used by another internal service try to use different port for global protect and make an internal portal.

https://live.paloaltonetworks.com/docs/DOC-3457

[cryptochrome]

That's a good idea, thanks. But I need to exclude other services, it's not just GP. For example, I need to terminate IPSec VPNs on the external interface. Or could I I use the same approach you described for that (e.g. terminate VPN on a loopback and NAT ipsec/ike to the loopback address)?

[panos]

side to side vpn you mean?

[cryptochrome]

yes.

well actually.... basically I want to know if I can make exclusions to a NAT rule. If not, I think the loopback interface might be the solution for everything

[panos]

I think you can use loopback for these exceptios.

I just tried for GP before but not for any other service.

Logic is the same so it should work.