Who rated this post


ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Who rated this post

L4 Transporter

@shafi021 it looks like @BPry got you taken care of with his reply.  I would just add that even if your firewall isn't using a public IP, and  your ISP was doing a source NAT on your outbound traffic, I wouldn't expect it to be doing any source NAT on the return traffic.  You would most likely see that the return traffic has the proper public IPs.  Also, the return traffic for established connections (those initiated from your LAN to the Internet) should be allowed anyway. 

You would most likely only have an issue w/ RFC1918 traffic going from your Public zone to your LAN zone if you were both 1) using private IPs on your firewall's Public interface because your ISP is doing source NAT, and 2) needing some other device on the network between your firewall and ISP's device (the Public zone according to the firewall, but the private side according to the ISP's NAT device) to the firewall's LAN zone.

If you're interested in a more comprehensive BOGO list than just RFC1918, I'm a fan of CYMRU's Full Bogon list, which also includes public IP ranges not yet allocated by IANA.  It can be used as an external dynamic list (EDL) on the Palo Alto firewall.

View solution in original post

Tags (2)
Who rated this post