New to PAN - coming from ASA - NAT nightmares

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

New to PAN - coming from ASA - NAT nightmares

L1 Bithead

Hi guys,

 

I have come from Cisco ASAs whereby it is super easy to create port forwarding/translation - really useful when only have single public IP.

 

object network web-server

 host 192.168.1.10

 nat (inside,outisde) static interface service tcp 80 80

 

 access-list outside extended permit any object web-server eq 80

 

I am finding this impossibly difficult on the Palo!  I have created a NAT as follows:

 

"INBOUND WWW; index: 4" {
nat-type ipv4;
from untrust;
source any;
to untrust;
to-interface ethernet1/1 ;
destination a.b.c.d;
service [ tcp/any/80 tcp/any/8080 ];
translate-to "dst: 172.22.1.10:80";
terminal no;

 

"UNTRUST TO WEB SERVER; index: 6" {
from untrust;
source any;
source-region none;
to trust;
destination a.b.c.d
destination-region none;
user any;
category any;
application/service web-browsing/tcp/any/80;
action allow;
icmp-unreachable: no
terminal yes;

 

Access to the webserver is not working and there is nothing in the live traffic logs - I'm sure I am doing something stupid if someone could hlpe...

 

Cheers,

Darren

1 ACCEPTED SOLUTION

Accepted Solutions

 

Hi @darren-bucknell

 

That's how you need to configure your policy in ordert to allow inbound traffic to your Web Server.

 

NAT Policy Example

Public-WWW.PNG

Private-WWW.PNG

 

Security  Policy Example

Security-Policy1.PNG

Security-Policy2.PNGSecurity-Policy3.PNG

 

Now if you need your WebServer to also access the Internet (Bidirectional) I can give another example, then the NAT policy will work a little bit different.

 

Let me know how it goes. 

 

 

 

 

 

 

 

View solution in original post

7 REPLIES 7

L1 Bithead

Fixed it - wrong zone <blush> 🙂

 

Hi @darren-bucknell

 

That's how you need to configure your policy in ordert to allow inbound traffic to your Web Server.

 

NAT Policy Example

Public-WWW.PNG

Private-WWW.PNG

 

Security  Policy Example

Security-Policy1.PNG

Security-Policy2.PNGSecurity-Policy3.PNG

 

Now if you need your WebServer to also access the Internet (Bidirectional) I can give another example, then the NAT policy will work a little bit different.

 

Let me know how it goes. 

 

 

 

 

 

 

 

Hey thanks for this Willian!

 

I used the "application (web-browsing)" ID and it worked.

 

Basically, I am getting used to the PAN zonal configuration that the ASA has no concept of.  It's a learning curve but will be worth it.

 

Best regards,

Darren

The web server does have a dynamic NAT (overload) policy configured.  Is there a better way?

 

Thanks in advance,

 

Darren

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!