New to PAN - coming from ASA - NAT nightmares

[darren-bucknell]

Hi guys,

I have come from Cisco ASAs whereby it is super easy to create port forwarding/translation - really useful when only have single public IP.

object network web-server

 host 192.168.1.10

 nat (inside,outisde) static interface service tcp 80 80

 access-list outside extended permit any object web-server eq 80

I am finding this impossibly difficult on the Palo!  I have created a NAT as follows:

"INBOUND WWW; index: 4" {
nat-type ipv4;
from untrust;
source any;
to untrust;
to-interface ethernet1/1 ;
destination a.b.c.d;
service [ tcp/any/80 tcp/any/8080 ];
translate-to "dst: 172.22.1.10:80";
terminal no;

"UNTRUST TO WEB SERVER; index: 6" {
from untrust;
source any;
source-region none;
to trust;
destination a.b.c.d
destination-region none;
user any;
category any;
application/service web-browsing/tcp/any/80;
action allow;
icmp-unreachable: no
terminal yes;

Access to the webserver is not working and there is nothing in the live traffic logs - I'm sure I am doing something stupid if someone could hlpe...

Cheers,

Darren

[darren-bucknell]

Fixed it - wrong zone <blush> 🙂

[acc6d0b3610eec313831f7900fdbd235 · Accepted solution]

Hi @darren-bucknell

That's how you need to configure your policy in ordert to allow inbound traffic to your Web Server.

NAT Policy Example

Security  Policy Example

Now if you need your WebServer to also access the Internet (Bidirectional) I can give another example, then the NAT policy will work a little bit different.

Let me know how it goes. 

[darren-bucknell]

Hey thanks for this Willian!

I used the "application (web-browsing)" ID and it worked.

Basically, I am getting used to the PAN zonal configuration that the ASA has no concept of.  It's a learning curve but will be worth it.

Best regards,

Darren

[darren-bucknell]

The web server does have a dynamic NAT (overload) policy configured.  Is there a better way?

Thanks in advance,

Darren