Palo NAT Question

palohelp — Thu, 17 Jul 2025 15:23:03 GMT

About the setup:

1. Both DC's are connected to partner via IPSec tunnel

2. Always prefer DC-1 & use DC-2 as backup

3. Panorama mgmt IPs gateways is on core switch

4. Palos point traffic to mgmt subnet towards core switch

5. Vendor access panorama using 3.3.3.99 (Nat IP)

Requirement:

1. The Nat IP needs to be advertised via BGP to DC-1. This can be achieved using a static route redistributed in bgp.

Question:

1. What should be the static routes next hop & Interface ?

topic Palo NAT Question in Next-Generation Firewall Discussions