NAT and Palo Alto

[alienbaby]

I have observed a Palo Alto do the following:

Original Source: Any -> Original Destination: Some subnet or IP -> Translated Source: outgoing Interface (or whatever IP you like) [Hide] .. Translated Destination: Original.

As I'm sure everyone here who's experienced, if you try this in a Check Point, it dies on Verify..

Who does PhoneBoy need to sleep with to get this functionality into Check Point Firewall-1 ???

and yes.. an ASA can do this too... and probably IPtables..

Use Case:

Publicly Available service; or Extranet service.. but the firewall, or path back to the firewall, is not the default gateway where the server is located.

[laf_c]

You guys sure have developed a crush for Phoneboy :).

[mcnallym]

Create an Address Range for the Source ( that covers the Internet ) rather then leave as Any.

[cciesec2006]

I have observed a Palo Alto do the following:

Original Source: Any -> Original Destination: Some subnet or IP -> Translated Source: outgoing Interface (or whatever IP you like) [Hide] .. Translated Destination: Original.

As I'm sure everyone here who's experienced, if you try this in a Check Point, it dies on Verify..

Who does PhoneBoy need to sleep with to get this functionality into Check Point Firewall-1 ???

and yes.. an ASA can do this too... and probably IPtables..

Use Case:

Publicly Available service; or Extranet service.. but the firewall, or path back to the firewall, is not the default gateway where the server is located.

What you said is correct on both Palo Alto and Cisco ASA with a caveat: You can use "Any" but you need to associate a "zone" to it.

[jflemingeds]

Create an Address Range for the Source ( that covers the Internet ) rather then leave as Any.

I'm Shocked, SHOCKED, well not that shocked, that the OP didn't test this in their lab. I know they have one. ;)

[alienbaby]

Having created some of the best hacks known to man, I know a hack when I see one...

And that's a hack.. logically, if I can do a source of 0.0.0.0/0.0.0.0, then 'Any' should work as well.

So seriously, Phoneboy needs to work those hips and make some change.

[PhoneBoy]

That reads like a product defect to me (specifically an issue in policy verification) versus an enhancement that needs to be made.
Anyone try to take this through TAC?

[ShadowPeak.com]

What you said is correct on both Palo Alto and Cisco ASA with a caveat: You can use "Any" but you need to associate a "zone" to it.

Right, and Security Zones are present in R80 management and can be used in NAT policies in this way. However Security Zones are not supported by pre-R80 gateways; without saying too much at this time I think it is pretty clear where Check Point's capabilities in this area are going...

[jflemingeds]

There must be some black magic under the hood for the "any" object. Checkpoint already has a SK saying how to work around this, which has already been covered.

sk21751

Also note: "Note: The workaround will not work for Static NAT."

Funny thing is it looks like R77.30 is missing the verification rule for this.

sk108278

[RayPesek]

... logically, if I can do a source of 0.0.0.0/0.0.0.0, then 'Any' should work as well.

Maybe "any" in Source or Destination works like "any" in Service; it doesn't mean "every". Like how X11 is specifically not included in "any" Service.

Ray