PAN-OS · NAT

PAN-OS-style: publish a server, and the pre-NAT rule

Publish SRV as 203.0.113.10. PAN-OS has a rule that catches almost everyone: a security rule names the address before NAT and the zone after NAT. The NAT rule goes from untrust to untrust, because before NAT the public address is out there. The security rule goes from untrust to dmz, because that is where the packet really goes, but it still names the public address.

Palo Alto PAN-OS-style track · Palo Alto PAN-OS-style, Cisco router · 4 objectives

Open in simulator More Palo Alto PAN-OS-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

ethernet1/3 at 172.16.1.1/24 in zone dmz, in virtual router default.
NAT rule PUB-WEB: from untrust to untrust, destination 203.0.113.10, translated to 172.16.1.10.
Security rule PUB-WEB: from untrust to dmz, destination 203.0.113.10, application web-browsing, service application-default, allow. Commit.
From LAP1: traffic tcp 203.0.113.10 80 payload "GET /index.html" arrives. The Traffic Log names your rule.

Start this lab

Before you start

Try the rule the way it looks right: destination 172.16.1.10, or to untrust. test security-policy-match and the Traffic Log show that interzone-default denies it. The rule’s two halves come from different moments in the packet’s life.

Concept

A security rule: the address before NAT, the zone after NAT

To publish a server, the NAT rule goes from untrust to untrust, because before NAT the public address is out there. The security rule goes from untrust to the server’s real zone, and still names the public address. Its two halves come from different moments in the packet’s life.

Concept

The candidate waits for commit

A PAN-OS-style firewall keeps two configurations. Your changes go into the candidate, and the firewall keeps running the old one until you commit. If the candidate has an error, the commit fails and nothing changes.