About CafNetMatt

The reason for this post is I'm collapsing 2 ASA that are configured one in front of the other into a single PANW firewall.  The DMZ interface on the inside ASA is technically treated as the "outside" interface.  All NAT is performed on this DMZ interface.  After the collapse, the DMZ interface will still exist but a true Outside interface will not be there.  NAT has to stay associated with the DMZ IP space because we only have a /30 for the Outside interface. From reading the NAT Tech Note I think I understand this but wanted to run it by here just in case. 3 interfaces.  Assume these are the zone names as well: Inside     192.168.0.1/24 DMZ        2.2.2.1/24 Outside    1.1.1.1/30 Wireless   172.16.0.1/24 DMZ addresses are public IPs. DMZ has servers assigned with IPs in this address space.  The rest of the address space is used for bi-directional NAT. Outside interface is the default route to the Internet. Regular inside traffic going to the Internet is SNAT'ed via the Outside interface IP. Wireless traffic going to the Internet uses a DMZ address for SNAT dynamic IP & port. Creating a bi-directional NAT with the NAT address of 2.2.2.2 for internal server IP 192.168.0.2 would be:                                                             Static Src Zone     Src IP              Dst Zone     NAT IP (bi-drectional = yes) Inside          192.168.0.2     DMZ            2.2.2.2 For the Wireless subnet SNAT using 2.2.2.3, it would be:                                                             Src Zone     Src IP               Dst Zone     NAT IP (dynamic IP & port) Inside         172.16.0.1/24     DMZ            2.2.2.3 The Dst Zone would be DMZ because when the route lookup is performed, the closest route is the directly connected route for the DMZ interface. The Security Policy allowing Internet traffic to reach the internal server would be: Src Zone     Src IP            Dst Zone     Dst IP      Action Outside       any                Inside          2.2.2.2     Allow Inside         192.168.0.2     Outside       Any         Allow The security policy for the Wireless traffic would be: Src Zone     Src IP       Dst Zone     Dst IP     Action Wireless      any           Outside       any         Allow Am I understanding this correctly? Thanks. Message was edited by: Matt Ausmus Updated to add wireless SNAT dynamic IP and port ... View more

Hi All, I'm migrating from ASA to Palo Alto including user VPN access (AnyConnect).  The setup will be 2 factor authentication with LDAP/Kerberos (not sure which yet) for the portal and OTP via RADIUS for the gateway. The current setup allows access lists to be applied via the vpn policy to each authenticated user group limiting their access to internal resources. My thought is to be able to build security policies providing these same limits that are based on the appropriate AD group.  This would allow me to have a single GP gateway & pool but still provide the same granularity they have now. My question is, does the user's AD username passthrough from the portal and mapped to their users GP IP even with RADIUS being used on the gateway?  I'm trying to avoid having to setup separate gateways with separate IP pools and having to base my security policies on the GP IP pools. I'm looking for best practices way of configuring this. Thanks for any suggestions. ... View more

I may be starting a migration soon that includes migrating URL filtering from an M86 to PAN. I'm trying to get up to speed on the M86 (haven't used it before) and wondered if anyone had any hints, recommendations or "gotchas" to watch out for. Currently perusing the M86 web filter user guide but that never paints the whole picture.  So, appreciate any suggestions. Matt ... View more