Vip(DNAT not working)

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Vip(DNAT not working)

L1 Bithead

ArunKumar7_0-1707441279489.png

This is my topology. From 30.0.0.10 i would like to access the server 192.168.0.2 with the help of PA wan interface IP(30.0.0.1)
I have created DNAT and Ssecurity policy .

ArunKumar7_1-1707441365240.png

 

ArunKumar7_2-1707441401377.png

 

Object Prenat IP is 30.0.0.1/8 and Webserver Ip is 192.168.0.2/24, when I try to open 30.0.0.1 from my web browser I am not able to see server's web page. I took a capture on server end and I don't see packet reaching the server.

Could you please help me to resolve the issue, am I missing somthing?


1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

your prenat IP should be 30.0.0.1/32 and postnat ip 192.168.0.2/32

if you add /8 and /24 subnets to the objects, you're telling your firewall to nat the entire /8 supernet somehow into the /24 subnet

 

 

your NAT rule needs to be:

from WAN to WAN 30.0.0.1/32 destination translate to 192.168.0.2/32

 

your security rule needs to be

from WAN to DMZ destination 30.0.0.1/32 any any allow

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

View solution in original post

1 REPLY 1

Cyber Elite
Cyber Elite

your prenat IP should be 30.0.0.1/32 and postnat ip 192.168.0.2/32

if you add /8 and /24 subnets to the objects, you're telling your firewall to nat the entire /8 supernet somehow into the /24 subnet

 

 

your NAT rule needs to be:

from WAN to WAN 30.0.0.1/32 destination translate to 192.168.0.2/32

 

your security rule needs to be

from WAN to DMZ destination 30.0.0.1/32 any any allow

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
  • 1 accepted solution
  • 933 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!