03-25-2013 06:37 PM
I'm currently having problems on PAN OS 5.0.1 replicating a standard Screenos MIP configuration. Whereby static nat and interzone/intrazone u-turn nat are all active at the same time.
We have multiple zones (5) all of the hosts inside each need to be able to access DMZ servers by their NATd public ip address (multiple dmz zones). Also unfortunately hosts inside the DMZ's sometimes want to talk back to themselves using their public ip address instead of their private.. Terrible I know..
Also when the DMZ servers talk to the internet they need to appear as their static natd public address.. when they talk to the internal (inside) network they appear as their standard private address..
Attached is a screenshot of the NAT configuration for 1 DMZ server..
The intrazone and interzone u-turn nating only work when the SNAT (static source translation) is not enabled..
Any thoughts?
I know we could be using split-dns.. and also this current design is begging for a re-architecture.. but we currently need to maintain status quo functionality for this firewall transition..
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
