Monday, September 17, 2018

Port Forwarding configuariton: Cisco ASA vs Palo Alto FW

In this post, I would like to talk about the difference in configuring port forwarding policies in Cisco ASA and Palo Alto FW.

Port Forwarding is also known as static IP NAT which is a very common configuration in the edge firewall/ routers to provide internal service access to outside network (exotically Internet).

I am going to use the following as an example. In this example, we are going to configure a port forwarding rule on the edge Firewall to forward 11.11.11.5:TCP 8080 to the internal Web Server 172.16.10.100:TCP 80.
From the following table, we can see in the "NAT Policy", the Dest-Zone in Palo Alto is the "pre NAT Zone" which is the "outside zone".

In the Security Policy, the Dest-Address and Service are both the Pre-NAT ones. 


ASA
Palo Alto
NAT Policy
Static NAT
Static NAT
Source Zone (interface)
outside
outside (or ANY)
Dest Zone (interface)
inside
outside (pre NAT Zone)
Original Source IP
any
any
Original Dest IP
11.11.11.5/32
11.11.11.5/32
Original Service
TCP/Dest-8080
TCP/Dest-8080
Translate Source IP
same as original
Translation Type: None
Translate Dest IP
172.16.10.100/32
172.16.10.100/32
Translate Service
TCP/Dest-80
TCP/Dest-80 (only can be Dest port)
Secuirty Policy


Source Zone (interface)
Assign Secuirty Poliyc to outside Interface
outside
Dest Zone (interface)
n/a
inside
Source Address
any
any
Dest Address
172.16.10.100/32 (post NAT IP)
11.11.11.5/32 (pre NAT IP)
Service
TCP/Dest-80 (post NAT Service)
TCP/Dest-8080 (pre NAT Service)


Thursday, September 6, 2018

Git Talk 02 - Difference between "git clone", "git pull" and "git fetch"

"git clone", "git pull" & "git fetch" have similar functionality which is copying the contents from remote repository to local. However, they have different cases.

"git clone"

When you build a new local directory and would like to copy the whole remote repository content to local, "git clone" should be used. So "git clone" is used after the "git init" of the local directory.


"git pull"

"git pull" will copy the update from the remote repository to local and merge to the current branch.

First, we need add the remote repository:


git remote add origin https://github.com/xxx/test.git


Then we can "git pull" the contents from the remote repo to local and merge to the current branch:


[root@localhost test01]# git pull origin
Updating 00d0c77..b5fd00c
Fast-forward
 test.txt   | 7 +++++++
 test01.txt | 4 ++++
 test05.txt | 1 +
 3 files changed, 12 insertions(+)
 create mode 100644 test01.txt
 create mode 100644 test05.txt


"git fetch"

"git fetch" will copy the update in the remote repo to local branch. But it will NOT merge the update to the current branch.



git fetch origin master:tmp
git merge tmp


The above commands will create a new branch call "tmp" and then copy the update to "tmp" branch. Then it merge the "tmp" branch to the master. So "git fetch" will only download the update from the remote repo. But it will not do merge. The "merge" will need to be done manually. 

In summary, "git clone" is used after you initialing the local directory for remote repo. "git fetch" will only download the update of the remote repo to local branch but merge will not happen automatically. "git pull" is equal to "git fetch" + "git merge".

NSX Load Balancer "Application Rules" Examples:

Load Balancing is one of the features provided by the NSX Edge Services Gateway (ESG). It can provide L7 Load Balancing by utilizing the HA...