topic Re: Source NAT question in General Topics

Source NAT question

CAMIEG — Thu, 01 Feb 2024 10:08:23 GMT

hello,

Is it possible to make NAT source by specifying the source port on which I appear for the remote server?

let me explain :

I am located in an inside zone and I would like to go to a specific zone that we will call "partner"
I would like to access a server at this partner by specifying my source port 5060. (not the destination port of the partner server)
The partner server must see me arriving at the source port 5060

Re: Source NAT question

Raido_Rattameister — Thu, 01 Feb 2024 14:04:43 GMT

If Source Address Translation is set to "Dynamic IP And Port" then Palo changes source port.

You can try with "Dynamic IP" or "Static IP".

They don't change source port.

With Static IP NAT policy you can map 1 internal IP to 1 wan IP only.

Re: Source NAT question

CAMIEG — Thu, 01 Feb 2024 14:35:25 GMT

in fact with "Dynamic IP" or "Static IP" the source port does not change but it is defined randomly by our server
We would like to go out with a source port defined by ourselves ex: 5353, however in Palo Alto when we select dynamic IP or static IP we can only choose the translated address and not the source port

Re: Source NAT question

Raido_Rattameister — Thu, 01 Feb 2024 14:55:09 GMT

You can't specify source port in Palo in NAT policy.

But as Palo is only passing traffic through you need to go to the device that is sending traffic and set the port where traffic should source from.

And if Palo is set to "Dynamic IP" or "Static IP" then this configured source port is not modified.

Re: Source NAT question

CAMIEG — Thu, 01 Feb 2024 15:02:36 GMT

thank you for the answer, unfortunately that's what I thought, modifying the source port from the server is not possible for me so we are blocked.
Don't you think the partner's request to arrive at a specific source port is crazy?

Re: Source NAT question

Raido_Rattameister — Thu, 01 Feb 2024 15:17:02 GMT

In general requesting specific source port is not reasonable unless it is voip.

Port 5060 refers to voip connection.

What voip software are you using on your side that can't send traffic from 5060?

Re: Source NAT question

CAMIEG — Thu, 01 Feb 2024 15:29:17 GMT

We use the Mivoice / Mitel solution
Our VOip solution provider tells us that we cannot configure the source port of the software to communicate