topic Re: Azure Nat Configuration in VM-Series in the Public Cloud

Azure Nat Configuration

r24481 — Tue, 25 Apr 2017 17:29:58 GMT

With the NAT VM no longer being required and you can assign a public address to NIC1 I have a question on the NAT process concerning only connectivity from resources to the interent. Do you need to configure a source nat policy or do you just forward traffic to 0.0.0.0/0 via a static route to the .1 address of the subnet on NIC1 and the Azure environment will do the translation? It is my understanding you only assign the public IP address to the VM NIC and do not assign this to an interface within the Palo Alto configuration?

Thanks,

Steve

Re: Azure Nat Configuration

niyengar — Tue, 25 Apr 2017 17:49:29 GMT

Steve,

For outbound, just add a static route that forwards trafffic as you suggest. I *think* you can just forward it to eth 1/1 (an not mention the ip address of the subnet) of the fw -- assuming eth1/1 is what NIC1 is connected to.

The NIC in Azure has the public IP and the firewall doesn't even see it. It only see the private address.

Re: Azure Nat Configuration

r24481 — Thu, 27 Apr 2017 19:45:30 GMT

I was not able to get this to work without putting a source nat policy in and after I put that in internet access is available.

nat-type ipv4;
from trust;
source any;
to INTERNET;
to-interface ethernet1/1 ;
destination any;
service any/any/any;
translate-to "src: ethernet1/1 x.x.x.x (dynamic-ip-and-port) (pool idx: 1)";