topic NAT Config in Next-Generation Firewall Discussions

NAT Config

Sanjay_Ramaiah — Mon, 30 Sep 2024 10:36:47 GMT

Hi Team,

In Checkp[oint we have an option to configure the dummy IPs in the NAT and use Proxy Arp to get it working. For example.

Source: 10.10.10.1

Destination: 10.100.100.1(Dummy IP)

Translation:

Source: 172.16.10.1(Dummy IP)

Destination: 172.17.25.1

And then configure the Proxy Arp and get this NAT working. This kind of NAT are used only to avoid overlapping subnets in the source and Destination end.

May i know how this can be achieved in PaloAlto? I dont really see such options on configuring dummy subnets in the NAT and get it working.

Regards,

Sanjay S

Re: NAT Config

Raido_Rattameister — Mon, 30 Sep 2024 16:26:39 GMT

You are referring to traffic coming from Internet towards Palo?

You can have dummy IP as destination IP if traffic arrives to Palo (destination mac address in the packet is mac of Palo wan interface).

If traffic is not sent to Palo mac then for Palo to reply with proxy arp it needs IP to be configured on the wan interface (this check is strict starting from 10.2.8, before that it worked even without IP on wan interface).

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/nat/nat-policy-rules/proxy-arp-for-nat-address-pools

Re: NAT Config

Sanjay_Ramaiah — Fri, 04 Oct 2024 12:47:52 GMT

Hi @Raido_Rattameister ,

No that is not the scenario. We have to NAT both Source and destination to avoid overlapping.

So it will be as below:

Original:

Source will have original IP

Destination will be Dummy IP

Tranlated:

Source will be Natted to dummy IP

Destination will translate to the original IP

In checkpoint we use the interface that will respond to Dummy IP will have the MAC ID responding to the Original Destination.

Re: NAT Config

Sanjay_Ramaiah — Tue, 08 Oct 2024 14:36:42 GMT

Thank you @Raido_Rattameister

I dont see the Dynamic NAT is working as expected. Basically Firewall is not proxing for the traffic.

As i updated in the beginning here we need to NAT Source with the dummy range before reaching the destination. And Destination will be NATted with the dummy range.

From source side we will be pinging the Dummy Destination IP. In the Destination side we should be seeing the Dummy Source IP..

I reffered the Link and configured as same as that but it is still not working 😞

Regards,

Sanjay S