topic PA-850 Static NAT between 2 Switches in Next-Generation Firewall Discussions

PA-850 Static NAT between 2 Switches

zbSA24 — Fri, 08 Mar 2024 17:01:33 GMT

Hello all. Looking for help here. I am trying to create a static NAT between two switches using a vwire, but it doesn't seem to be working. Can someone please provide steps on how to make this happen? I do not wish to insert routers between the switches, and wasn't sure if this was possible. I'm new to networking and firewalls, and have been tasked to try and figure this out. Any help would be greatly appreciated.

Thanks in advance!

Zach (a struggling SA)

Re: PA-850 Static NAT between 2 Switches

Claw4609 — Fri, 08 Mar 2024 17:26:15 GMT

Hello,

What does your NAT rule look like? And what exactly is happening, is it not translating?

Heres an example for the docs: Virtual Wire Static NAT Example (paloaltonetworks.com)

Re: PA-850 Static NAT between 2 Switches

zbSA24 — Fri, 08 Mar 2024 17:41:41 GMT

So I've been looking at that example myself, and i can't figure out if those routers are physical routers or are they the virtual routers offered in the firewall?

Re: PA-850 Static NAT between 2 Switches

zbSA24 — Fri, 08 Mar 2024 17:42:59 GMT

When i try to test the NAT, it says no Rule matched. Unfortunately, my equipment is not on an unclass platform that i can take pictures and stuff.

Re: PA-850 Static NAT between 2 Switches

zbSA24 — Fri, 08 Mar 2024 17:59:50 GMT

here is something i drew up on pp to try and illustrate my problem. my rules matched what was in the document.

Re: PA-850 Static NAT between 2 Switches

Claw4609 — Fri, 08 Mar 2024 19:37:53 GMT

I guess Im confused from your picture what you're trying to NAT. In the document those are two routers, not virtual routers on the firewall. Those two routers are not being NAT between each other. One is 198.51.100.1 and the other is 198.51.100.2, with .2 having a route for 198.51.100.100/32 pointing to the other router of .1.

What are you trying to translate to what and what are you trying to solve? If youre trying to have 192.51.100.1/28 route to 192.51.100.2/28 and you have the Palo in-between you wouldn't need to necessarily nat between the two, they would just have to have routes to know where to go.

Re: PA-850 Static NAT between 2 Switches

zbSA24 — Fri, 08 Mar 2024 20:07:55 GMT

Ok, so my inside switch has a vlan with an ip of 192.51.100.x, and I am trying to translate that to a vlan on my outside switch, to an ip of 22.59.95.x.

Re: PA-850 Static NAT between 2 Switches

zbSA24 — Fri, 08 Mar 2024 20:08:49 GMT

the PA-850 doesn't like it because it says the translated address isn't in the same subnet (or network for that matter). But isn't that the purpose of the NAT?