real ip mapping

[daba1974]

hell

i have a subnet of real IP address for example (84.85.86.1/28) and to reach this subnet i have a connectiosn from the serrvice provider with the following wan ip  for example (90.91.92.1) .

i configured the Palo with the real ip 90.91.92.1 and i have no problem in internet browsing and everything is working fine.

i want to use the subnet (84.85.86.1/28) over paloalto to map it the ips of this subnet into different services localy, but i want to keep all of this inside this paloalto device only.

is this possible , and how it can be done?

Regards,

[rmonvon · Accepted solution]

Hi...Your ISP should have a route entry for net 84.85.86.1/28 use next-hop 90.91.92.1.  On the PA device you can assign a 2nd IP 84.85.86.1/28 to the same interface of 90.91.92.1, and create inbound/outbound NAT rules as needed to map the 84.85.86.x IPs to your private IPs.

Thanks.

[mikand]

Do one have to assign that 2nd iprange to an interface on PA for NAT to work?

[daba1974]

I tried with your instruction but it didn't work, i have to mention that the interface that use the ip address 90.91.92.1 use vlan tagging.

i added the subnet 84.85.86.1/28 to the interface as you mentioned and create a NAT policy as following

Tag none
source zone: internet
destination zone : local
destination interface :any
source address : any
destination address :test1
services: any
source translation :none
destination:address:test2

test1 is an ip address from the rane 84.85.86.1/28
test2 is a local host address

i tested tracing to the true subnet from internet and it show the proper path till reaching my WAN ip