NAT for ldap

[jpzynski]

I need to configure my PAN to allow LDAP and port 636 inbound from 10 specific IP addresses for authentication with a software company. Can't figure out how to do this correctly.

[kprakash · Accepted solution]

Hi

You can write a Destination NAT with the source IP address as the 10 IP adresses, the source zone as "untrust",  the destination address with the public IP address of the ldap server, the destination zone as "untrust", service as 636 under the original packet section. Under the translated packet section, click on the check box of the "destination address translation" and give the private IP address of the ldap server.

Write a corresponding security rule with the source IP address as these 10 IP addresses, the source zone as "untrust", the destination IP address as the "public IP address of the server", the destination zone as "trust ( or DMZ, where the server is located), application = LDAP, service =any, and action= allow.

Best regards,

Karthik

[jpzynski]

Thank you. Do I need to create each of the 10 IP addresses manually/individually in the PAN first or on the fly as part of the rule?

[kprakash]

You could create address objects for these IP addresses, and use these address objects under the NAT and the security rules,if you want to identify the users based on a string / identity. You also have an option of adding these IP addresses on the fly when creating the new rules.

BR,

Karthik