topic Re: Hit count cannot increase after NAT in General Topics

Hit count cannot increase after NAT

DavidyPalo — Thu, 30 Dec 2021 21:07:43 GMT

Hi U-turn nat is configured for trust user to ping server located at DMZ. After the user ping the server from trust zone to dmz zone, the security policy count increases, but nat policy count does not increase. Is this normal? if not, why it happen? thank you

Re: Hit count cannot increase after NAT

PavelK — Sat, 01 Jan 2022 14:49:16 GMT

Thank you for the post @DavidyPalo and Happy New Year!

Based on my experience if NAT U-turn policy is configured correctly and traffic is hitting it, the counter will increase. Could you go to Device > Troubleshooting > The select Test: NAT Policy Match? After you fill all the details, you can click on Execute to see the result of NAT policy match.

Typical use case of U-turn NAT is accessing internal resource by using external IP address, however based on NAT policy screen shot you provided, the destination IP address is an internal IP address and destination translated IP address is not visible in screen shot. Would it be possible to provide more details what you want accomplish?

Thank you and Regards

Pavel

Re: Hit count cannot increase after NAT

DavidyPalo — Mon, 03 Jan 2022 20:53:13 GMT

Thank you PaveIK for your reply. You are correct. Now the issue resolved.

BTW, when you mentioned "Could you go to Device > Troubleshooting > The select Test: NAT Policy Match? "

Why I cannot see the "Troubleshooting" on my PA? Please see my screenshot below

Re: Hit count cannot increase after NAT

PavelK — Mon, 03 Jan 2022 21:58:19 GMT

Thank you for reply @DavidyPalo

This feature has been introduced in PAN-OS 9.0: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/device/device-troubleshooting.html If you are running PAN-OS 8.1, you will not see Troubleshoot Tag until you upgrade to 9.0 and higher.

Kind Regards

Pavel

Re: Hit count cannot increase after NAT

DavidyPalo — Mon, 03 Jan 2022 22:54:59 GMT

Thank you!