This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About criiser
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About criiser
08-18-2015
4Posts
0Likes
0Solutions
Aug 18, 2015Last Visited
User
Activity
User
Profile
Latest posts by criiser
| Subject | Views | Posted |
|---|---|---|
| 2427 | 01-07-2013 02:05 AM | |
| 2427 | 01-07-2013 12:53 AM | |
| 2558 | 01-06-2013 10:12 AM | |
| 1421 | 10-18-2012 02:06 AM |
User Badges
Community Statistics
| Member Since | 03-16-2012 04:39 AM |
| Date Last Visited | 08-18-2015 09:07 AM |
| Posts | 4 |
01-07-2013
02:05 AM
Damn thats the change I needed to make... I read the advanced NAT PDF and I got the impression that It first nats THEN check policies... Obviously, this is NOT the case SO by adding the external IP to the ruleset - BAM, it started working right of the bat... I soo searched for DHCP on this site and NAT.. And did not get it to work But with your great help.. It-s working like a charm.. SO The zone reflect the NATted actions, but the IP does not. Not that obvious imho... And not like any other FW i've worked. with... Juniper, Checkpoint, Clavister..... So, one more thing to get used to Again, THANKS!!! Much appreciated !!! /C
... View more
01-07-2013
12:53 AM
I thought it would.. SO I have, Sec pol: src - Untrust - any -any - any dst - Unstrust - any - (Application) ms-rdp - services (any) - allow - options log Also have: src - Untrust - any -any - any dst - Trust- internal.server.object- (Application) ms-rdp - services (any) - allow - options log Also tried - Chaging Application to ANY and services to the same I used in the NAT rule. service-ms-rdp... NAT policy: src zone: Untrust dst: zone Untrust: any - any - dest adress: External DHCP interface Service: (Created service-ms-rdp 3389) - dest translation: internal.server.object The sad part is - I don't see anything in the logs... And nothing in the debug flow either... How would you go about troubleshoot it? And, Is there an object with the "DHCP-assigned.address" that one can use instead of the one I made that will not update if the DHCP client gets an new address... Br, Christian
... View more
01-06-2013
10:12 AM
So, PAN 5.0.1 eth1/1 - Layer 3 / Internal network 10.0.0.1/24 eth1/2 - Layer 3 / External network - DHCP assigned IP adress from ISP. Outbound NAT works. Inbound NAT i simply doesnt get to work.. Used the cli command test nat-policy-match from Untrust source 8.8.8.8 destination [assigned ip adress of eth 1/2] destination port 3389 protocol 6 Got rule matched on that.. Followed that up with debug dataplane packet-diag set filter match destination [ip adress of etch1/2] debug dataplane packet-diag set filter on debug dataplane packet-diag set log feature flow basic debug dataplane packet-diag clear log log debug dataplane packet-diag set log on Then several: tail mp-log pan_packet_diag.log Nothing in that log End result wanted.. Traffic going to DHCP assigned IP is NAT:ed into internal network. Ie. Satelite office ISP's gives us dhcp issued adresses / or one static / I want to host services such as rdp / ssh etc etc. IPSEC is not an option in this scenario. Ideas for sollution? Is it even possible??? BR, Christian
... View more
Labels:
- Labels:
-
Configuration
-
Networking
-
Troubleshooting
10-18-2012
02:06 AM
Would anyone by any chance know the "default" syslog string ie. with the parameters $path etc etc... Would be interesting to know to have something to start from instead of beginning, like now, clean... Br, Christian
... View more
- Tags:
- custom_format
- syslog
Labels:
- Labels:
-
Configuration
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-18-2015
09:07 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks