NAT rule

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

NAT rule

L3 Networker

Hello

 

I have a problem. I have a firewall Palo Alto. Eth1 (20.74.34.3) is configured on public zone and eht1/2 is configured in the internal zone (10.110.0.4). Inside the internal network, I have a dmz subnet 10.111.0.0/24 where I have 2 web servers for application (app1 10.111.0.10 and app2 10.111.0.11)

 

How I can configure the NAT rule to access these web server from computers connected on Internet ?

 

Regards

 

4 REPLIES 4

L2 Linker

You can either use bidirectional NAT or create two NAT rules for this.

 

Bi-Directional NAT:
++++++++++++++++++++

Source Zone : DMZ
Dest Zone : INTERNET
Source IP : 10.111.0.10
Source Translated IP : <SRV_PUBLIC_IP>
Bi-directional : Yes
Destination : Any

Limitations:
+++++++++++

1.This creates an automated NAT rule for the reverse flow with source Zone as "Any"
2.You can't use DNS Rewrite

Two NAT Rules
++++++++++++++


Source Zone : DMZ
Dest Zone : INTERNET
Source IP : 10.111.0.10
Source Translated IP : <SRV_PUBLIC_IP>
Bi-directional : No
Destination IP : Any
Destination Translated IP : None

 

Source Zone : INTERNET
Dest Zone : INTERNET
Source IP : Any
Source Translated IP : None
Bi-directional : No
Destination IP : <SRV_PUBLIC_IP>
Destination Translated IP : 10.111.0.10


@murali438 wrote:

You can either use bidirectional NAT or create two NAT rules for this.

 

Bi-Directional NAT:
++++++++++++++++++++

Source Zone : DMZ
Dest Zone : INTERNET
Source IP : 10.111.0.10
Source Translated IP : <SRV_PUBLIC_IP>
Bi-directional : Yes
Destination : Any

Limitations:
+++++++++++

1.This creates an automated NAT rule for the reverse flow with source Zone as "Any"
2.You can't use DNS Rewrite

Two NAT Rules
++++++++++++++


Source Zone : DMZ
Dest Zone : INTERNET
Source IP : 10.111.0.10
Source Translated IP : <SRV_PUBLIC_IP>
Bi-directional : No
Destination IP : Any
Destination Translated IP : None

 

Source Zone : INTERNET
Dest Zone : INTERNET
Source IP : Any
Source Translated IP : None
Bi-directional : No
Destination IP : <SRV_PUBLIC_IP>
Destination Translated IP : 10.111.0.10


Hello,

 

Thank you. Is it possible to create the NAT rule based in the fqdn to be sûre,  that the access to the internal application will only work and match if user uses https://application1.mycompany.com or htpps://application2.mycompany.com ? Because as I share the same IP public for each application (each application has the Palo Alto IP public,  20.74.34.3, as a reverse proxy), what's happening if users uses htpps://20.74.34.3 ?

 

BR

L2 Linker

To be sûre to understand, the PA must be able to resolve the fqdn with the public IP (application1.company.com=20.74.34.3) peut with the private IP (application1.company.com=10.111.0.4)?

 

Br

  • 1534 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!