topic Re: Possible NAT issue on a PA-3260 in General Topics

Possible NAT issue on a PA-3260

tech_geek2023 — Fri, 16 Feb 2024 08:30:49 GMT

Folks, I am trying to configure a NAT policy which should be bi-directional. Here the traffic can be initiated from outside or the inside. The policy is configured and I can see NAT hits. However, this policy does not work.

The NAT IP is from a subnet which does not reside on the Untrust interface. This is where I see the possible challenge is. The reason to say this is that the PA does not show the NAT IP in it ARP database.

Is there some dedicate configuration required on the PA that announces this NAT IP belongs to the PA? Here is an article I found and wanted to run it through the community.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGZCA0

Regards,

Re: Possible NAT issue on a PA-3260

BPry — Sat, 17 Feb 2024 05:13:47 GMT

@tech_geek2023,

The article has the three ways that you can fix this. The vast majority of the time I see people just create a route for the traffic to get around this instead of assigning secondary IPs or utilizing loopbacks or anything like that; just add a route for your public IP range that you'll be using to NAT addresses and you'll be good to go.

Re: Possible NAT issue on a PA-3260

tech_geek2023 — Mon, 19 Feb 2024 07:31:57 GMT

I tried the route addition as well but it has not helped. Any other suggestions or comments on this?

Re: Possible NAT issue on a PA-3260

reaper — Mon, 19 Feb 2024 14:10:33 GMT

if you need to 'own' ip addresses on an interface without adding them to said interface, you can use an inbound NAT rule with 'original destination' set to those IP addresses. the firewall will then proxy arp for those IP's

the rule would be something like:

from untrust

to untrust

destination interface <external interface>

original source any

original destination <the IP you want to proxy-arp e.g. 198.51.100.1>

translated destination <the internal IP e.g. 10.0.0.1>

a ticked "bi-directional" check box may not suffice to get proxy-arp to work for not-attached IP addresses