topic BI-DIRECTIONAL STATIC NAT NOT WORKING in Next-Generation Firewall Discussions

BI-DIRECTIONAL STATIC NAT NOT WORKING

zGomez — Tue, 31 Oct 2023 15:58:51 GMT

Hi,

I have the following situation I want to do a bi-directional NAT for a complete subnet range.

I want to translate 192.168.96.0/24 --> 10.196.96.0/24 :

192.196.96.1 --> 10.196.96.1

192.168.96.2 --> 10.196.96.2

...

And this in both directions.

When i select bi-directional nat on the NAT policy it is not working for the inbound direction.
screenshot is not corrrect orginal rule has bi-directional set to yes

When i create 2 seperate rules it is working:

With the bi-directional it is not doing the nat. What am I doing wrong on the bi-directional nat?

I actually like it more when i create seperate nat rules because then you have control over the source zone and it is clear from policy.

But i just want to understand why the bi-directional is not working.

Re: BI-DIRECTIONAL STATIC NAT NOT WORKING

Raido_Rattameister — Tue, 31 Oct 2023 16:08:35 GMT

bi-directional creates 2 nat rules behind the scenes and you can see both of them in cli.

Usually bi-directional messes up zone names so you should never use it and create 2 separate rules instead.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClWBCA0

"Note: The destination NAT rule that is created in a Bi-directional rule, the Source Zone and Source Address in the original packet will be ANY. This can break some traffic if the rule is set up as a Static Source NAT with Bi-Directional. For granular control over the Source and Destination NAT rules, create them separately. This may be necessary if the Bi-Directional NAT is not working in a given configuration."