Port Forwarding configuariton: Cisco ASA vs Palo Alto FW

In this post, I would like to talk about the difference in configuring port forwarding policies in Cisco ASA and Palo Alto FW.

Port Forwarding is also known as static IP NAT which is a very common configuration in the edge firewall/ routers to provide internal service access to outside network (exotically Internet).

I am going to use the following as an example. In this example, we are going to configure a port forwarding rule on the edge Firewall to forward 11.11.11.5:TCP 8080 to the internal Web Server 172.16.10.100:TCP 80.

From the following table, we can see in the "NAT Policy", the Dest-Zone in Palo Alto is the "pre NAT Zone" which is the "outside zone".

In the Security Policy, the Dest-Address and Service are both the Pre-NAT ones. 

	ASA	Palo Alto
NAT Policy	Static NAT	Static NAT
Source Zone (interface)	outside	outside (or ANY)
Dest Zone (interface)	inside	outside (pre NAT Zone)
Original Source IP	any	any
Original Dest IP	11.11.11.5/32	11.11.11.5/32
Original Service	TCP/Dest-8080	TCP/Dest-8080
Translate Source IP	same as original	Translation Type: None
Translate Dest IP	172.16.10.100/32	172.16.10.100/32
Translate Service	TCP/Dest-80	TCP/Dest-80 (only can be Dest port)
Secuirty Policy
Source Zone (interface)	Assign Secuirty Poliyc to outside Interface	outside
Dest Zone (interface)	n/a	inside
Source Address	any	any
Dest Address	172.16.10.100/32 (post NAT IP)	11.11.11.5/32 (pre NAT IP)
Service	TCP/Dest-80 (post NAT Service)	TCP/Dest-8080 (pre NAT Service)

Git Talk 02 - Difference between "git clone", "git pull" and "git fetch"

"git clone", "git pull" & "git fetch" have similar functionality which is copying the contents from remote repository to local. However, they have different cases.

"git clone"

When you build a new local directory and would like to copy the whole remote repository content to local, "git clone" should be used. So "git clone" is used after the "git init" of the local directory.

"git pull"

"git pull" will copy the update from the remote repository to local and merge to the current branch.

First, we need add the remote repository:

git remote add origin https://github.com/xxx/test.git

Then we can "git pull" the contents from the remote repo to local and merge to the current branch:

[root@localhost test01]# git pull origin Updating 00d0c77..b5fd00c Fast-forward  test.txt   | 7 +++++++  test01.txt | 4 ++++  test05.txt | 1 +  3 files changed, 12 insertions(+)  create mode 100644 test01.txt  create mode 100644 test05.txt

"git fetch"

"git fetch" will copy the update in the remote repo to local branch. But it will NOT merge the update to the current branch.

git fetch origin master:tmp git merge tmp

The above commands will create a new branch call "tmp" and then copy the update to "tmp" branch. Then it merge the "tmp" branch to the master. So "git fetch" will only download the update from the remote repo. But it will not do merge. The "merge" will need to be done manually. 

In summary, "git clone" is used after you initialing the local directory for remote repo. "git fetch" will only download the update of the remote repo to local branch but merge will not happen automatically. "git pull" is equal to "git fetch" + "git merge".