NAT question

[jochristian]

Hello,

I have migrated a configuration from an netscreen firewall.

On the netscreen on the outside interface (against the internet) there are two mip ip's configured,

one of the MIP ip's are on the same subnet as the ip on the main ip. But the other IP is on a different subnet.

Like this:

main public ip: 192.168.1.1/29

MIP ip one: 192.168.1.2

MIP ip two: 10.1.1.10

I had no problems making the correct configuration for NAT on the MIP one ip. Inbound to a mailserver.

But I am struggeling doing the configuration for MIP ip two. It does not work.

Do I need to add the MIP ip two as a loopback ip on the untrust zone or can I add it to the interface as a secondary ip? 10.1.1.10/32.

How do I make the nat configuration for the MAP two ip?

Can anyone help?

Jo Christian

[kbrazil]

Hi Jo,

The destination NAT IP does not need to be in the same subnet as the interface IP in our implementation for this to work.  The PAN device will ARP for the address and all should work fine.

There are a couple ways to convert a ScreenOS MIP to PANOS NAT rules:

1. Create two separate NAT Rules: One destination NAT inbound with zones Untrust to Untrust.  Then another source NAT outbound with zones Trust to Untrust
   
   or
   
   
2. Create a single source NAT outbound with zones Trust to Untrust, then flag it as bidirectional (PANOS 3.1 and above)

Once you have your NAT rule(s) then make sure the Security Policy has correct rules allowing the traffic in using the original (pre-NAT) IPs.

Cheers,

Kelly

[jochristian]

Hello and thanks for your reply.

Yes this is what I did (your suggestion number 2) but when making the security policy my rule always get "tagged" as unused when hitting the "show unused" button. Is there some way to debug the reason for the rule being tagged as unused?

I don't have any other rules that should interfere with this one.

Jo Christian

[kbrazil · Accepted solution]

Hi Jo,

Typically when traffic is not hitting a NAT or Security policy it is due to some sort of routing or lower-level issue.  To debug these types of issues you might check the drop counters or do a debug flow basic to see how the traffic is being processed and at what stage it is being dropped.  Support can also help out with this.

Here is some quick information on how to check the counters and the debug flow basic:

Show Drop Counters

Set a filter to control what traffic is counted

debug dataplane packet-diag set filter match <criteria>

debug dataplane packet-diag set filter on

Show the drop counters (absolute or relative to last time command was run)

show counter global packet-filter yes | match drop

show counter global filter severity drop packet-filter yes delta yes

Debug Flow Basic

Set a filter to control what traffic is logged

debug dataplane packet-diag set filter match <criteria>

debug dataplane packet-diag set filter on

Enable debug logging

debug dataplane packet-diag set log feature flow basic

debug dataplane packet-diag clear log log

debug dataplane packet-diag set log on

View the debug log (tail or less)

less dp-log pan_packet_diag.log

tail dp-log pan_packet_diag.log

Hope that helps,

Kelly

[jochristian]

Hello,

Everything working now. Had to restart the DSL modem for the other subnet to work correctly.

Thank you for your help!

Jo Christian