About cstech

Please correct any wrong statements: 1. I connect my PA to the "untrust internet" via ethernet 1/1 2. My ISP assigned me 164.67.80.0/24 block of IPV4 addresses (actually this is a lie...) 3. I assigned 164.67.80.2/24 to ethernet 1/1 4. The PA is capable of running NAT on any of the addresses in the entire 164.67.80.0/24 subnet using Proxy ARP 5. I want to run a GlobalProtect HTTPS server on 164.67.80.3 6. The GlobalProtect Portal will not allow (5). 7. The reason for (6) is that 164.67.80.3 is not bound to ethernet 1/1.  The GlobalProtect HTTPS portal cannot use Proxy ARP. 7. I cannot bind 164.67.80.3/24 to ethernet 1/1 as a subinterface because it is on the same subnet as 164.67.80.1/24 8. I cannot run my GlobalConnect portal on 164.67.80.3, my preferred IP address 9. I must run GlobalConnect HTTPS Portal on the un-preferred IP address 164.67.80.2. Thank you, Chris ... View more

Hello, 1. I have three zones: Public, DMZ, Private Public interface: bound to 164.67.80.124/26 Private interface: bound to 192.168.1.1/24 DMZ interface: bound to 192.168.2.1/24 2. I use bi-directional NAT to expose a few of the DMZ machines via their own public IP addresses: 164.67.80.77 <-> 192.168.2.77 164.67.80.78 <-> 192.168.2.78 164.67.80.79 <-> 192.168.2.79 Example: Source zone: DMZ Destination zone: Public Destination Interface: any Source Address: 192.168.2.77 Destination Address: any Service: any Source Translation: static-ip, 164.67.80.77, bi-directional: yes Destination Translation: none 3. I add security policies to allow the DMZ machines to access the internet and be accessed from the internet. 4. None of my interfaces are explicitly bound to 164.67.80.77, 78, or 79.  This works due to something called "Proxy ARP" on the public interface (as explained to me in these discussion forums). 5. I add a "Source NAT" policy with the intention of providing internet access to the Private zone: Source zone: Private Destination zone: Public Destination Interface: any Source Address: any Destination Address: any Service: any Source Translation: dynamic-ip-and-port, 164.67.80.124 Destination Translation: none 6. I don't yet add a security policy to allow Private machines to the Public zone. 7. After step 5, the communication between the DMZ and Public stops.  Internet cannot access the DMZ machines via the public IP addresses and the DMZ cannot access the internet. Question: Why does the DMZ stop working when I perform step 5? Thank you, Chris ... View more