NATing same IP public address for different service (port forwarding)-Destination NAT

05/06/2021

Author: Samer R. Saleem

Subject: NATing per service (port forwarding)

 

As you might see on another posts, Network requirements change from time to time, which will impose new changes each time.

One of the new scenarios that came into my table was allowing a remote sever to access three finger print devices that works with UDP service.

 

Of course, I need to make use of my public IP and not waste IP addresses, and sure, the obvious solution for this requirement would be the Network Address translation (NAT).

 

The following diagram represents the idea of the connection:

 So, our target is to translate the incoming connection according to the requested service:

or example:

if the connection was for the IP: X.X.X.X with UDP port 5500, the Firewall will translate the connection destination to 10.10.180.11

if the connection was for the IP: X.X.X.X with UDP port 5501, the Firewall will translate the connection destination to 10.10.180.12

 

Finally, if the connection was for the IP: X.X.X.X with UDP port 5502, the Firewall will translate the connection destination to 10.10.180.13

 

Login to firewall user interface
go to policies > NAT > add

to add a rule with the name of finger print device do the following:
source zone outside destination outside  (the first outside is the internet, the second one is Interface outside of the firewall)
destination IP is X.X.X.X  (which is a real public IP address that you will use to make port forwarding)
service must be (5500, 5501, 5502)  >>> (if not defined, you can define under objects tab). 

screenshot on how to do that:

 

 

here is how to configure and will use the first finger print device in my examples:

Source is outside > destination outside with port > 5500

destination address is the PUBLIC IP (X.X.X.X)

now, go to next tab (Translated Packet), which will take action after the packets translated and will redirect the traffic to internal IP address of the Finger print device1

fill the details as below, and then press OK

 once you done this for device1 you can repeat the process for the other devices.

then allow security access rule
go to security policy
add a new rule
source zone outside, address any to inside zone destination is 95.159.105.100 service ports are 5500,5501,5502 > action is allow

 

then commit configs

 

Hope this was useful!

 

Samer R. Saleem

 

Security Policy Testing on PaloAlto Firewall

Firewalls in an active working environment will always be susceptable to change in configuration, hosts will be added to new policies and removed later, or added to one or more of the security policies at the same time, this of course will cause some problems at some point, especially if the rule hits were not as intended to be and some server or IP will lose access to internet or DMZ.

Here we will see how to find out if the same host was added to one or more security rules by simulating a trace which is similar to packet tracer of the Cisco ASA firewalls to some extent. 

How to test your configuration for a specific host to see in which policy it might be?

What if the host was used in more than security policy?

 

How to know If there is conflict for the same host?

 

There are two ways for the same test.

A.    Go to Device > Troubleshooting

B.    Go to Security Policy > Select “Test Policy” which can be found at the bottom bar

 

Both of these options will do the same thing.

 

So let’s see how it works.

Using option B, we are going to press on the test policy option which you can see "in the right corner of the screen"

we will start filling the details:

1. Source interface (Inside, outside, DMZ) in our case it is (Inside)

2. Destination Interface (Insidde, outside, DMZ) in our case it is (Outside)

3. Select the protocol type (TCP, UDP, ICMP) for this example we are going to use (ICMP)

once you selected the ICMP, the destination port is no longer needed.

Here as you can see below, our source will be a host that was added previsouly to a security rule named (DIRECT-INTERNET-ACCESS) and the ip address of this host is (10.211.112.2)

The destination in our policy is Google (8.8.8.8)

there is another useful option that can be seen in the screen below:

"Show all potential match rules until first allow rule"

once you entered all details as the in the screen, you can scroll-down to "excute" option and press it, right away you will see the "test result" showing the matching rule "Direct-Internet-Access"

Now you can select this rule and check out it's "result details" tab on the right.

scroll-down to the end, now you can see if the Action is "Allowed or Denied"

Type is "interzone or universal" 

You can then see if there is duplicate for the same host IP with another rule that might cause a hit and prevent the host from working in another intended way, and resolve the misconfiguration.

Hope this was useful!

Samer R. Saleem

Installing PaloAlto Certificate on Mobile phones or Computers - Traffic decryption

 As you all know, controlling smart phones in a Network could be a challenge. 

Especially these day many mobile applications works with  the secured version of HTTP > (HTTPS)

As a solution that might be useful for many of us is URL filtering.

Since Firewalls need to make SSL scanning or (Decryption) for HTTPS traffic to do that because as you know, HTTPS is encrypted.

you can do the decryption on the firewall which of course will have some impact on your firewall resources, but if you don't have a lot of users to apply decryption policy then that should be fine.

In my post, I'm going to apply decryption policy using PALOALTO firewall, which I think is a great firewall.

you can review the creation of the policy from an older post here on my blog on this link >

https://pbitccie.blogspot.com/2020/08/ssl-decryption-policy-on-paloalto.html

however, in regards to exporting and installing certifications on your devices, I will post here:

1. In order to export the certification you need to go to Device > Certificate management > certificates

2. select the certificate which was generated by the LAB Firewall and in my case it is showing with the firewall inside IP address of 10.211.250.253

3. choose the export option at the end of the page

4. you will get a drop list option from the window that will open and you will need to select the option

(.PEM or .DER) one of them is applicable to Windows and IPHONE, and the second is for Android based smart phones.

5. press OK and the certificate will be downloaded to your local disk.

now you need to import on your target device (PC, IPHONE, ANDROID phone)

NOTE: on PC you will need to install as trusted certificate.

on IPHONE you can email it to yourself and download it to your iphone then install from Settings> General > Profiles

on Android devices it can be installed from Advanced Wifi settings (look it up in google)

Once this all done, you can check if the users traffic is getting decrypted by the Firewall

go to > Monitor > Decryption

Or Go to > URL filter option and check the traffic for the filtered traffic there

NOTE: make sure the user does not have a direct access to internet and his IP is available in decryption policy and in Access Policy it must be applied with the URL filter options that you need (Allowed or Denied)

I hope this was helpful to you!

Thanks

Samer R. Saleem

Enable sending PaloAlto Firewall logs to Email Account

 If you are using PALO-ALTO Firewalls, which they are great products according to my experience, you would not want to be connected all the time to check events/threats and monitor the everything all the time.

this would be time waste and of course you will not get better benefits from sitting the whole time in front of the screen.

 

Other way is enabling log forwarding to an external receiver.

the options available to forward the logs are as below:

1. SNMP

2. EMAIL

3. SYSLOG

4. HTTP

Creating Log forwarding, select the option and click on ADD:

Go to Objects > Log Forwarding > Add

Now add the information below:

Select from the Log type drop list> I'm selecting threats which will check vulnerabilities and Viruses and File checking and this of course will include Wildfire submissions as you can see in my email list below

A great option to use here will be EMAIL, you can send threats for a specific rule to your EMAIL Inbox.

For Example, an important rule like incoming rules used to allow emails coming inbound to Exchange server or security policy rule for the traffic allowed to hosts accessing internet.

 

you will be able to add the option to get alerts for threats coming in emails for example.

here is how to enable the Log forwarding to email:

you should see a drop list under the option Log Forwarding:

at the end this what you will start seeing in your email feed:

The type is threat, source IP and destination IP, the name of the policy which in my case is INCOMING-EMAIL, Logset which is the log type we chose as logging forward to email

 

 

 

 

 

 

 

 

 

 

 

 

you can do the same for any log forward enabled policy.

Hope this was useful!

#CCIE #NETWORKSECURITY #PCNSE #PCNSA #PALOALTONETWORKS

Samer R.Saleem