topic Re: Bi-direction Nat logic in Next-Generation Firewall Discussions

Bi-direction Nat logic

IAmJi1 — Mon, 24 Feb 2025 03:52:36 GMT

hi I have configured a static bidirection NAT which is Trust to Untrust source address 10.149.192.32 destination 10.90.129.51 service any source translation 200.22.1.32 and turned the bi-directional: yes.

I have the security policy any and routing 10.149.0.0/16 and 200.22.0.0/16 is Trust,10.90.129.51 Untrust. I have done troubleshooting from Trust to Untrust source 10.149.192.32 to 10.90.129.51 worked but i have tried the other way which is Untrust to Trust source 10.90.129.51 to destination 200.22.1.32 it did not match the bidirection NAT. When I tried Untrust to Untrust source 10.90.129.51 to destination 200.22.1.32 matched the bidirection NAT policy.

since its bi direction should it match Untrust to trust?

May I know the reason for this please?

Re: Bi-direction Nat logic

JayGolf — Tue, 25 Feb 2025 04:18:22 GMT

Hi @IAmJi1 ,

Quick question, why do you have 200.22.0.0/16 set to inside? How is your VR setup? This could be the reason why your NAT isn't getting hit. Your FW treats 200.22.1.32 as an internal address that lives within the Trust zone. So it seems your FW is routing rather than ever needing to hit that bi-directional DNAT you got there.

I would also recommend creating a separate DNAT policy. I recommend a separate DNAT policy because "bi-directional" feature creates a second NAT policy that states the Source Zone and Source Address in the original packet will be ANY.

For example:

Here is a helpful KB on Bi-Directional NAT also check out this Destination NAT Example.

Re: Bi-direction Nat logic

IAmJi1 — Tue, 25 Feb 2025 04:52:12 GMT

thank you for your reply Jay

we have several ways to get to outside thats why 200.22.0.0/16 is routed Trust

what I don't understand is why does "bi-directional" feature creates second NAT policy Destination Zone as Untrust? why not trust? (there is another router thats in middle of firewall and the devices so the policy works for Trust to Untrust but it did not work for Untrust to Trust)

Re: Bi-direction Nat logic

Raido_Rattameister — Wed, 26 Feb 2025 18:09:44 GMT

"why does "bi-directional" feature creates second NAT policy Destination Zone as Untrust?"

Because if traffic is initiated from Internet side then it is hitting WAN IP of the Palo.

Palo's WAN interface is in Untrust zone and that is why destination zone is Untrust.

I never use bi-directional nat policies as they can cause errors in more complex environments.

It is best always to set up 2 nat policies yourselves. One for SNAT and other for DNAT.

Re: Bi-direction Nat logic

IAmJi1 — Thu, 27 Feb 2025 00:56:55 GMT

Is there any supporting documents about your answer? Because in the knowledgebase it does not clarify why it makes destination zone untrust.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClWBCA0

it would be great if you could provide some supporting documents

thank you for your answer

Re: Bi-direction Nat logic

Raido_Rattameister — Thu, 27 Feb 2025 02:42:20 GMT

https://live.paloaltonetworks.com/twzvq79624/attachments/twzvq79624/members_discuss/15121/1/TechNote_UnderstandingNAT.pdf