Source-NAT with POOL from GlobalProtect zone to subnet behind the MPLS router

larry2019 — Tue, 11 Oct 2022 22:05:45 GMT

Hi community,

I'm writting this post to get any ideas or suggestions in a new end-customer requirement. The main goal is that all clients connected via GlobalProtect can access to a new services acquired recently via MPLS (attached the brief topology). The point here is the MPLS's administrator share a specific IP Address that we need to NAT any source address from the Firewall Palo Alto.

We asigned the 192.168.130.0/24 pool to dynamic-client and we need to get access to 172.21.2.9 through out MPLS and it indicates us we have to NAT with 192.168.1.222 IP address; the config applied works, the traffic from the dynamic-client to 172.21.2.9 leave the firewall with 192.168.1.222 but, we can't connect and the session detail shows "application = incomplete/undecided"

This is the brief flow-traffic:

In advanced, thank you so much for your reply!

Re: Source-NAT with POOL from GlobalProtect zone to subnet behind the MPLS router

OtakarKlier — Wed, 12 Oct 2022 21:08:22 GMT

Hello,

Make sure the policies are marked with 'Log at session end'. Then check the logs to see if any traffic is getting blocked. Could be a misconfigured security policy.

Regards,

topic Source-NAT with POOL from GlobalProtect zone to subnet behind the MPLS router in GlobalProtect Discussions

Source-NAT with POOL from GlobalProtect zone to subnet behind the MPLS router

Re: Source-NAT with POOL from GlobalProtect zone to subnet behind the MPLS router