[LAB 05] Destination NAT implementation in Palo Alto FW | recorded in [ENGLISH] upon viewers request
#DestinationNAT #Implementation #paloalto #Firewall
@BeingProactive
DESTINATION NAT
Another way we can give access to the Web server from the outside zone, is to implement the Destination NAT from the user’s perspective sitting on the internet, unlike Destination NAT, in source NAT we have assigned NAT rule in Server’s perspective and translated the source address I.e. server’s local IP 10.2.2.20 to static IP 192.168.1.249 with the bidirectional feature/functionality enabled, thereby, firewall first matches the NAT rule with the corresponding security policy rule defined for allowing users from the internet to access the web server from global IP 192.168.1.249 which is a translation of source (server local IP) 10.2.2.20.
Note: Security policy is always going to use Post NAT zones and Pre NAT addresses, if we are implementing Destination NAT.
Security rule we gonna use post NAT zones and the way the security rules operate is that the NAT rules are evaluated but not implemented until after the security policy is checked, that also means we are including as part of a security rules is the PRE NAT addresses that's why we are pointing in the security policy to the outside the global pretranslated address as far as the security rule for permissions.
Setting Up DMZ Web Server Access | Static Source NAT | from Servers perspective
• [LAB 04] Setting up DMZ Web Server Access ...