Monday, September 17, 2018

Port Forwarding configuariton: Cisco ASA vs Palo Alto FW

In this post, I would like to talk about the difference in configuring port forwarding policies in Cisco ASA and Palo Alto FW.

Port Forwarding is also known as static IP NAT which is a very common configuration in the edge firewall/ routers to provide internal service access to outside network (exotically Internet).

I am going to use the following as an example. In this example, we are going to configure a port forwarding rule on the edge Firewall to forward 8080 to the internal Web Server 80.
From the following table, we can see in the "NAT Policy", the Dest-Zone in Palo Alto is the "pre NAT Zone" which is the "outside zone".

In the Security Policy, the Dest-Address and Service are both the Pre-NAT ones. 

Palo Alto
NAT Policy
Static NAT
Static NAT
Source Zone (interface)
outside (or ANY)
Dest Zone (interface)
outside (pre NAT Zone)
Original Source IP
Original Dest IP
Original Service
Translate Source IP
same as original
Translation Type: None
Translate Dest IP
Translate Service
TCP/Dest-80 (only can be Dest port)
Secuirty Policy

Source Zone (interface)
Assign Secuirty Poliyc to outside Interface
Dest Zone (interface)
Source Address
Dest Address (post NAT IP) (pre NAT IP)
TCP/Dest-80 (post NAT Service)
TCP/Dest-8080 (pre NAT Service)

Thursday, September 6, 2018

Git Talk 02 - Difference between "git clone", "git pull" and "git fetch"

"git clone", "git pull" & "git fetch" have similar functionality which is copying the contents from remote repository to local. However, they have different cases.

"git clone"

When you build a new local directory and would like to copy the whole remote repository content to local, "git clone" should be used. So "git clone" is used after the "git init" of the local directory.

"git pull"

"git pull" will copy the update from the remote repository to local and merge to the current branch.

First, we need add the remote repository:

git remote add origin

Then we can "git pull" the contents from the remote repo to local and merge to the current branch:

[root@localhost test01]# git pull origin
Updating 00d0c77..b5fd00c
 test.txt   | 7 +++++++
 test01.txt | 4 ++++
 test05.txt | 1 +
 3 files changed, 12 insertions(+)
 create mode 100644 test01.txt
 create mode 100644 test05.txt

"git fetch"

"git fetch" will copy the update in the remote repo to local branch. But it will NOT merge the update to the current branch.

git fetch origin master:tmp
git merge tmp

The above commands will create a new branch call "tmp" and then copy the update to "tmp" branch. Then it merge the "tmp" branch to the master. So "git fetch" will only download the update from the remote repo. But it will not do merge. The "merge" will need to be done manually. 

In summary, "git clone" is used after you initialing the local directory for remote repo. "git fetch" will only download the update of the remote repo to local branch but merge will not happen automatically. "git pull" is equal to "git fetch" + "git merge".

NSX Load Balancer "Application Rules" Examples:

Load Balancing is one of the features provided by the NSX Edge Services Gateway (ESG). It can provide L7 Load Balancing by utilizing the HA...