https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-nat-session-distribution-as-a-way-to/ta-p/1229347 <DIV class="lia-message-template-content-zone"> <H2 class="lia-align-center"><STRONG><FONT color="#FF6600">Palo Alto Networks NAT Session Distribution as a Way to Implement Server Load Balancing</FONT></STRONG></H2> <P>&nbsp;</P> <P>&nbsp;</P> <P>The Palo Alto Network Destination NAT&nbsp;Session Distribution can be used to implement similar to Load Balancer functionality by using one of the "distribution" methods.</P> <P>&nbsp;</P> <P>You need to allow the traffic with a with a security policy rule from the correct source zone to the correct destination zone.</P> <P>&nbsp;</P> <P><EM>Useful additions are SNAT and SSL Inbound:</EM></P> <P>&nbsp;</P> <UL> <LI>Combining this feature with Source NAT will make certain that the servers will return the traffic to the firewall and not to cause asymmetric routing but then the servers will not see real client IP address.</LI> <LI>SSL Inbound Inspection will allow inbound HTTPS/SSL traffic to be inspected before being load balanced to the destination servers. This will allow IPs and antivirus inspections.</LI> </UL> <P>&nbsp;</P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="nikoolayy1_2-1747492747777.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/67654i692CDB0D69B8DD5E/image-size/large?v=v2&amp;px=999" role="button" title="nikoolayy1_2-1747492747777.png" alt="nikoolayy1_2-1747492747777.png" /></span> <P>&nbsp;</P> <P>You can create address group that contains the different server's IP addresses.</P> <P>&nbsp;</P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="nikoolayy1_1-1747492645684.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/67653i8E58BA74D8483EA6/image-size/large?v=v2&amp;px=999" role="button" title="nikoolayy1_1-1747492645684.png" alt="nikoolayy1_1-1747492645684.png" /></span> <P>&nbsp;</P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="nikoolayy1_0-1747493140861.png" style="width: 1001px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/67658i66E41DE03188DBAA/image-dimensions/1001x373?v=v2" width="1001" height="373" role="button" title="nikoolayy1_0-1747493140861.png" alt="nikoolayy1_0-1747493140861.png" /></span> <P>&nbsp;</P> <P>The selected translated IP address can be seen in the "Traffic" logs that in this case is "192.168.1.1". You can also use DNS FQDN address.&nbsp;</P> <P>&nbsp;</P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="nikoolayy1_0-1747492597436.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/67652i622600B625227951/image-size/large?v=v2&amp;px=999" role="button" title="nikoolayy1_0-1747492597436.png" alt="nikoolayy1_0-1747492597436.png" /></span> <P>&nbsp;</P> <P>&nbsp;</P> <H3><STRONG>Summary:</STRONG></H3> <P>&nbsp;</P> <P>This feature allows the implementation of basic load balancer but if the application is stateful then the correct distribution method needs to be selected like "Source IP HASH" as to always select the same server.</P> <P>&nbsp;</P> <P>&nbsp;</P> <H3><STRONG>References:</STRONG></H3> <P>&nbsp;</P> <UL> <LI><A href="https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-networking-admin/session-settings-and-timeouts/session-distribution-policies-overview/session-distribution-policy-descriptions" target="_blank" rel="noopener">Session Distribution Policy Descriptions</A></LI> <LI><A href="https://docs.paloaltonetworks.com/network-security/decryption/administration/decryption-overview/ssl-inbound-inspection" target="_blank" rel="noopener">SSL Inbound Inspection</A></LI> <LI><A href="https://docs.paloaltonetworks.com/network-security/decryption/administration/enabling-decryption/configure-ssl-inbound-inspection" target="_blank" rel="noopener">Configure SSL Inbound Inspection</A></LI> </UL> <P>&nbsp;</P> </DIV> Fri, 30 May 2025 17:27:31 GMT nikoolayy1 2025-05-30T17:27:31Z https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-nat-session-distribution-as-a-way-to/ta-p/1229347 <P>The Palo Alto Network Destination NAT&nbsp;Session Distribution can be used to implement similar to Load Balancer functionality by using one of the "distribution" methods.</P> Fri, 30 May 2025 17:27:31 GMT https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-nat-session-distribution-as-a-way-to/ta-p/1229347 nikoolayy1 2025-05-30T17:27:31Z https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-nat-session-distribution-as-a-way-to/tac-p/1230705#M800 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/153031">@nikoolayy1</a>&nbsp;,</P> <P>&nbsp;</P> <P>Thanks for putting this together !</P> <P>Very useful !</P> Mon, 02 Jun 2025 14:26:32 GMT https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-nat-session-distribution-as-a-way-to/tac-p/1230705#M800 kiwi 2025-06-02T14:26:32Z https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-nat-session-distribution-as-a-way-to/tac-p/1230978#M802 <P>Very nicely written and informative!!</P><P>Thank You!</P> Wed, 04 Jun 2025 16:08:58 GMT https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-nat-session-distribution-as-a-way-to/tac-p/1230978#M802 mkalyani 2025-06-04T16:08:58Z https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-nat-session-distribution-as-a-way-to/tac-p/1231109#M804 <P>Great post! <span class="lia-unicode-emoji" title=":thumbs_up:">👍</span> This feature is super handy for load balancing. Thanks for highlighting that!</P> Thu, 05 Jun 2025 18:50:02 GMT https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-nat-session-distribution-as-a-way-to/tac-p/1231109#M804 emgarcia 2025-06-05T18:50:02Z https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-nat-session-distribution-as-a-way-to/tac-p/1231343#M809 <P data-sourcepos="5:3-5:173">This is explained incredibly well-appreciate the additional references!&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/153031">@nikoolayy1</a>&nbsp;</P> <P data-sourcepos="7:1-7:51">&nbsp;</P> Mon, 09 Jun 2025 20:23:05 GMT https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-nat-session-distribution-as-a-way-to/tac-p/1231343#M809 crasmussen 2025-06-09T20:23:05Z