topic DNAT not working in Next-Generation Firewall Discussions

DNAT not working

ArunKumar7 — Fri, 09 Feb 2024 07:58:39 GMT

This is my topology. From 30.0.0.10 i would like to access the server 192.168.0.2 with the help of PA wan interface IP(30.0.0.1)
I have created DNAT and Security policy .

Object Prenat IP is 30.0.0.1/8 and Webserver Ip is 192.168.0.2/24, when I try to open 30.0.0.1 from my web browser I am not able to see server's web page. I took a capture on server end and I don't see packet reaching the server.

Could you please help me to resolve the issue, am I missing something?

Re: DNAT not working

reaper — Fri, 09 Feb 2024 08:23:43 GMT

unfortunately your screenshots are too small to see what you configured

your prenat IP should be 30.0.0.1/32 and postnat ip 192.168.0.2/32

if you add /8 and /24 subnets you're telling your firewall to nat the entire /8 supernet somehow into the /24 subnet

your NAT rule needs to be:

from WAN to WAN 30.0.0.1/32 destination translate to 192.168.0.2/32

your security rule needs to be

from WAN to DMZ destination 30.0.0.1/32 any any allow

Re: DNAT not working

ArunKumar7 — Fri, 09 Feb 2024 08:37:00 GMT

Thanks , you resolved the issue.

Changed the subnet to /32 and it worked