Web server publishing error

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Web server publishing error

L1 Bithead

Hi!

 

Help, please, with an Internal Web server publication.

 

I have a PaloAltor PA-200, PanOS 7.0.19.

 

I have ext. Internet on Eth1/1 (L3-Untrust zone) and LAN on Eth1/2 (L3-Trust zone). In my LAN I have a Server with Web publication (WebServer), which should be accessd from outside (Internet).

 

I`m trying to publish it. But got an error: Mismatch of destination address translation range between original address and translated address

 

Could someone, please, help with fixing th NAT and policy.

 

nat.pngpolicy.png

1 accepted solution

Accepted Solutions

okay, that's good.

 

make the following changes:

 

in Webpub: 

1) make sure "Internet" is your public ip.

 

in Webout:

1) in source translate put your public ip and remove destination translation entry

 

~HTH

View solution in original post

14 REPLIES 14

Cyber Elite
Cyber Elite

Hello,

The destination zone in your screen shot needs to be the same zone that the web server resides in.

 

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/networking/nat/nat-configuration-exa...

 

Hope that helps.

Thanks for response!

 

Trying to change zone, but got same error. Maybe you could suggest anything else?

 

nat2.png

Also the destination address should be the IP of the webserver. 

Sorry menat the translated address. However here is one of my nat rules. Its a bi-directional rules, all that means that incoming traffic and outgoing traffic use the same external IP address.

 

image.png

Just as a personal preference I use NAT rules to just translate and use the security policies to dictate which services are allowed.

Thanks!

 

Trying to change main NAT, but unsuccessfully. Any ideas?nat3.png

What IP does your LAN object translate to? It should just be the webservers address.

LAN - 10.154.10.1/16

WebServer - 10.154.10.7

Hello,

Put the Webserver address into your NAT rule.

 

image.png

 

Then it should work.

Hi!

 

Tried to change it, but lost access from LAN to Internet. Same time couldn`t connect the WebServer from outside.

 

Maybe there is another way to do it?

L3 Networker

if i am assuming correct, 

 

you are using one public ip and you are planing to use port 80 for webserver.

 

To set this up i would set up two different Nat statements, one for outbound only, that will translate your internal network to public ip, it would look something like this:

 

for outbound Nat:

 

security rule :

 

source ip : your internal ip

destination ip: any

source zone: trust

destination zone :untrust

service : http

 

Nat policy:

 

source ip : your lan ip

source zone: internal

detination ip : any

destination zone: untrust

source Nat  to untrust interface ip

 

 

for inbound web server:

 

 

security rule :

 

source ip : any

destination ip: <your public ip>

source zone: untrust

destination zone :trust

service: http

 

Nat policy:

 

source ip : any

source zone: untrust

detination ip : your public ip

destination zone: untrust

destination nat : internal web server ip

 

 

~HTH

Thanks!

 

I`m trying to change it, but have a next mistake again. Maybe I mistaked somewhere?

 

nat4.png

okay, that's good.

 

make the following changes:

 

in Webpub: 

1) make sure "Internet" is your public ip.

 

in Webout:

1) in source translate put your public ip and remove destination translation entry

 

~HTH

Thanks a lot to all for help!!!

 

For me working like this:

 

nat5.png

Glad i could help,

 

Please accept post as a solution if it helped.

 

~Harry

  • 1 accepted solution
  • 4928 Views
  • 14 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!