Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Using public range of IPs

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Using public range of IPs

L4 Transporter

I have a bit of a silly question to ask but my mind is drawing a blank on this.  If you have a connection from the ISP, say the static IP range is 14.1.1.0/30....their router is 14.1.1.1 and the PA FW will be 14.1.1.2.  Simple enough but what if they also give you a usable range of IPs to use, say 15.1.1.0/27.   To use these IPs , would you need to assign the external interface an additional IP on 15.1.1.0/27 subnet, or could you just create NAT rules that NAT traffic to IPs in that range?

 

1 accepted solution

Accepted Solutions

L3 Networker

Hi,

 

You can use those new prefixes IP's for NAT pool and also bind it to internal servers and you give direct to server or routers aswell. And for routing you have provide reachability and also u have to advertise towards ISP for reachability in & out Through given ISP network.

 

Best Regards,

Suresh

 

 

Sureshreddymudhireddy

View solution in original post

6 REPLIES 6

L3 Networker

Hi,

 

You can use those new prefixes IP's for NAT pool and also bind it to internal servers and you give direct to server or routers aswell. And for routing you have provide reachability and also u have to advertise towards ISP for reachability in & out Through given ISP network.

 

Best Regards,

Suresh

 

 

Sureshreddymudhireddy

@SureshReddyM 

 

Thanks. So does it make sense to assign one of the IPs as an additional IP of the external interface?  This way firewall knows that range is part of untrust zone?

Yes. Make sure that those prefixes have to reachable in and out using routing and adv. With protocols or static route if single home connection.

 

Regards,

Suresh

 

Sureshreddymudhireddy

L4 Transporter

@ce1028  You don't need to assign any IP form the new range to your interface if your ISP is advertising it for you over the internet. 

Just add a static route for the new IP range towards the external interface. Rest is usual Nat and security policy. 

That is ISP is advertising that this 15.1.1.0/27 subnet can be reached through your link. You also point it towards your external link and use the IP's from that range in NAT and security policies. 

@raji_toor @SureshReddyM 

 

Thank you both!

you don't even need to add routes (unless the IP range lives on a different interface than where 0.0.0.0/0 goes out of)

 

When you create NAT rules that use this new subnet, the firewall will perform proxy arp for the IP addresses (or entire subnet) you configure in the NAT rule. Adding a 'destination interface' in the NAT rule will help the firewall identify which interface these proxy-ARP packets need to go out of

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
  • 1 accepted solution
  • 4609 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!