topic Re: Prefix to Prefix NAT on Palo Alto Firewalls in Next-Generation Firewall Discussions

Prefix to Prefix NAT on Palo Alto Firewalls

HKoppuravori — Mon, 19 Jun 2023 16:01:23 GMT

Hello,

Can we configure prefix-to-prefix NAT translations on Palo Alto firewalls? Is there any easy way to do this?

For Example -

SRC - 10.1.1.0/24

DST - 1.1.1.1

SRC Translation to 10.1.2.0/24

SRC - 1.1.1.1

DST - 10.1.1.0/24

DST Translation to 10.1.2.0/24

Re: Prefix to Prefix NAT on Palo Alto Firewalls

TomYoung — Tue, 20 Jun 2023 01:24:57 GMT

Hi @HKoppuravori ,

That should work as you configured, and it should keep the 4th octet the same. It's strange that I can only find examples in old documentation ->

https://live.paloaltonetworks.com/twzvq79624/attachments/twzvq79624/members_discuss/15121/1/TechNote_UnderstandingNAT.pdf&usg=AOvVaw02L8sXzzghkPL6rZ1xmvhE&opi=89978449. See Example #5 on page 18.

Thanks,

Tom

Re: Prefix to Prefix NAT on Palo Alto Firewalls

aleksandar.astardzhiev — Tue, 20 Jun 2023 10:19:58 GMT

Hey @HKoppuravori ,

I can confirm what @TomYoung explained, just to highlight that this is possible as long as the original and translated networks are exactly the same lenght - /24 natted to /24, or /28 natted to /28. Commit will fail if you try to nat different prefixes.