nat with port forwarding issue (migrating from MS-TMG)

[agrgic]

Hi,

when migrating rules from MS-TMG to PAN i have encountered folowing situation:

a. web server A is in private dmz zone

b. web server B is in inside zone

Both are listenig on port 80. Problem is in the fact that both are published on the same public IP address. This is supported on TMG, with some kind of url forwarding but i dont know if PAN can support this kind of design.

I tried to create port forwarding but one rule shadows the another, even with PBF.

Any suggestion?

[mikand]

As far as I know PA doesnt support loadbalancing based on content (for that purpose use F5 or similar devices which you can place behind a PA).

So in your case you have to either:

1) Server A gets publicip:TCP80, Server B gets publicip:TCP81 (or whatever port you want to use).

or

2) Server A gets publicip1:TCP80, Server B gets publicip2:TCP80.

[agrgic]

Your options are ok, i had them in mind, but i hoped that PA had some similar feature like TMG to ease migration procedures. I'll get back with results after i do some more tests.

thnx

[vertical]

definitely what TMG does is not possibe with a PA and mikand's answer provides the only choices we have to migrate TMG. The company I'm working for has also a TMG and I've get to handle the migration coming soon.

I've talked this issue through with an SE from PAN to a definite answer on this.