This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About harishsidhartha
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About harishsidhartha
11-09-2021
3Posts
0Likes
0Solutions
Nov 09, 2021Last Visited
User
Activity
User
Profile
Latest posts by harishsidhartha
| Subject | Views | Posted |
|---|---|---|
| 6390 | 04-25-2021 07:25 PM | |
| 7591 | 04-17-2021 09:39 PM | |
| 1509 | 04-16-2021 06:58 PM |
User Badges
Community Statistics
| Member Since | 04-15-2021 02:59 PM |
| Date Last Visited | 11-09-2021 07:23 PM |
| Posts | 3 |
04-25-2021
07:25 PM
Hi @DongQu , As @aleksandar.astardzhiev rightly mentioned, you need to add static routes as follows. 1) 1.1.1.0/24 via tunnel1 2) 2.2.2.0/24 via tunnel1 3) 0.0.0.0/0 via <Outside interface> (you need to provide the static route for both 1.1.1.0 and 2.2.2.0 to tunnel 0. else it will not work) The configuration I provided works fine in my lab. Regards, Harish Sidhartha
... View more
04-17-2021
09:39 PM
What I could understand from your question is that you want to enable a Two way NAT (NAT on both sides). Below is the configs for the first Palo Alto for Two way NAT. (Full subnet Static NAT). I have used Source based NAT on both sides with Bidirectional NAT Enabled. 10.100.100.x/24 to 1.1.1.x/24 10.200.200.x/24 to 2.2.2.x/24 set deviceconfig system hostname PA-NAT-Testing set network interface ethernet ethernet1/1 layer3 ip 10.100.100.1/24 set network interface ethernet ethernet1/1 layer3 interface-management-profile Mgt-Ping-SSH-Https set network interface ethernet ethernet1/1 comment Inside set network interface ethernet ethernet1/2 layer3 ip 172.16.1.1/24 set network interface ethernet ethernet1/2 layer3 interface-management-profile Mgt-Ping-SSH-Https set network interface ethernet ethernet1/2 comment Outside set network interface tunnel units tunnel.1 ip 3.3.3.1 set network interface tunnel units tunnel.1 interface-management-profile Mgt-Ping-SSH-Https set network interface tunnel units tunnel.1 comment NatTunnel set network ike crypto-profiles ike-crypto-profiles default encryption [ aes-128-cbc 3des ] set network ike crypto-profiles ike-crypto-profiles default hash sha1 set network ike crypto-profiles ike-crypto-profiles default dh-group group2 set network ike crypto-profiles ike-crypto-profiles default lifetime hours 8 set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-128 encryption aes-128-cbc set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-128 hash sha256 set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-128 dh-group group19 set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-128 lifetime hours 8 set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-256 encryption aes-256-cbc set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-256 hash sha384 set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-256 dh-group group20 set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-256 lifetime hours 8 set network ike crypto-profiles ipsec-crypto-profiles default esp encryption [ aes-128-cbc 3des ] set network ike crypto-profiles ipsec-crypto-profiles default esp authentication sha1 set network ike crypto-profiles ipsec-crypto-profiles default dh-group group2 set network ike crypto-profiles ipsec-crypto-profiles default lifetime hours 1 set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-128 esp encryption aes-128-gcm set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-128 esp authentication none set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-128 dh-group group19 set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-128 lifetime hours 1 set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-256 esp encryption aes-256-gcm set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-256 esp authentication none set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-256 dh-group group20 set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-256 lifetime hours 1 set network ike crypto-profiles global-protect-app-crypto-profiles default encryption aes-128-cbc set network ike crypto-profiles global-protect-app-crypto-profiles default authentication sha1 set network ike gateway Palo2 authentication pre-shared-key key <Key> set network ike gateway Palo2 protocol ikev1 dpd enable yes set network ike gateway Palo2 protocol ikev2 dpd enable yes set network ike gateway Palo2 local-address ip 172.16.1.1/24 set network ike gateway Palo2 local-address interface ethernet1/2 set network ike gateway Palo2 protocol-common nat-traversal enable no set network ike gateway Palo2 protocol-common fragmentation enable no set network ike gateway Palo2 peer-address ip 172.16.10.1 set network virtual-router default interface [ ethernet1/1 ethernet1/2 tunnel.1 ] set network virtual-router default routing-table ip static-route "Route to internet" nexthop ip-address 172.16.1.2 set network virtual-router default routing-table ip static-route "Route to internet" interface ethernet1/2 set network virtual-router default routing-table ip static-route "Route to internet" metric 10 set network virtual-router default routing-table ip static-route "Route to internet" admin-dist 10 set network virtual-router default routing-table ip static-route "Route to internet" destination 0.0.0.0/0 set network virtual-router default routing-table ip static-route "Route to internet" route-table unicast set network virtual-router default routing-table ip static-route local-site-NAT interface tunnel.1 set network virtual-router default routing-table ip static-route local-site-NAT metric 10 set network virtual-router default routing-table ip static-route local-site-NAT destination 2.2.2.0/24 set network virtual-router default routing-table ip static-route local-site-NAT route-table unicast set network virtual-router default routing-table ip static-route Local-site-NAT2 interface tunnel.1 set network virtual-router default routing-table ip static-route Local-site-NAT2 metric 10 set network virtual-router default routing-table ip static-route Local-site-NAT2 destination 1.1.1.0/24 set network virtual-router default routing-table ip static-route Local-site-NAT2 route-table unicast set network virtual-router default routing-table ip static-route "route to Palo2" interface tunnel.1 set network virtual-router default routing-table ip static-route "route to Palo2" metric 10 set network virtual-router default routing-table ip static-route "route to Palo2" destination 10.170.0.0/16 set network virtual-router default routing-table ip static-route "route to Palo2" route-table unicast set network tunnel ipsec NatTunnel auto-key ike-gateway Palo2 set network tunnel ipsec NatTunnel tunnel-monitor enable no set network tunnel ipsec NatTunnel tunnel-interface tunnel.1 set zone Trust network layer3 ethernet1/1 set zone untrust network layer3 [ ethernet1/2 tunnel.1 ] set rulebase security rules "Permit Any" to any set rulebase security rules "Permit Any" from any set rulebase security rules "Permit Any" source any set rulebase security rules "Permit Any" destination any set rulebase security rules "Permit Any" source-user any set rulebase security rules "Permit Any" category any set rulebase security rules "Permit Any" application any set rulebase security rules "Permit Any" service any set rulebase security rules "Permit Any" source-hip any set rulebase security rules "Permit Any" destination-hip any set rulebase security rules "Permit Any" action allow set rulebase nat rules SubnetNAT source-translation static-ip translated-address 1.1.1.0/24 set rulebase nat rules SubnetNAT source-translation static-ip bi-directional yes set rulebase nat rules SubnetNAT to untrust set rulebase nat rules SubnetNAT from Trust set rulebase nat rules SubnetNAT source 10.100.100.0/24 set rulebase nat rules SubnetNAT destination any set rulebase nat rules SubnetNAT service any set rulebase nat rules SubnetNAT to-interface tunnel.1 set import network interface [ ethernet1/1 ethernet1/2 tunnel.1 ]
... View more
04-16-2021
06:58 PM
I am trying to POC a scenario for my customer in AWS with dual Palo Alto in HA within same availability zone. (We need to build a site to Site VPN tunnel from on-Premises to AWS Palo behind IGW) I am facing a strange issue. I an not able to reach the outside Elastic IP address of Palo.(I am able to reach the public IP on Management interface). The ENI's are moving to the secondary on failover. I have deployed Palo Alto Primary FW and Secondary FW. All Security Groups are configured to permit all traffic. No NALC’s configured. Main VPC is 10.180.0.0/16 There are 4 Subnets: Public 10.180.100.0/24, Management 10.180.110.0/24, Private 10.180.120.0/24 and HA 10.180.130.0/24 There are 2 route tables - Public and Private 3 subnets (Public, Management and HA) are associated with Public Route Table and Private subnet is associated with Private RT. Internet Gateway is attached to VPC. Default route is configured in Public RT pointing to IGW. Communication from Public RT is up as the Test PC and Palo Management interface is able to reach internet. Palo Alto is configured with Static IP and static default route pointing to the first IP of Public subnet (10.180.100.1) Palo Configured with Security policy to permit all traffic. Palo management profile permits ping, ssh, https Elastic Public IP is attached to the Public and Management ENI’s. Palo Primary have 4 ENI's - Management (elastic IP), Public (elastic IP), HA and Private. Source/destination check is disabled on all ENI's HA configured and is syncing the configs with peer. Data plane Interface is moving to the Secondary Palo on failover. Management IP is reachable, test PC in public subnet is reachable, but Palo’s public IP is not. I re-created this lab at least 10 times now. The interesting thing is that, I was able to reach the external public IP of Palo yesterday but is not working after another rebuild. Am I missing something here? Can any one help me resolve this issue?.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-09-2021
07:23 PM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks