topic Nat in General Topics

Nat

Sarou22 — Wed, 31 Jul 2024 15:19:57 GMT

Hello,

I Saw this on a website

"Security policies differ from NAT rules in that security policies examine post-NAT zones to determine whether the packet is authorized or not."

I don't understand why because it's the packet without NAT ( no NAT) that reaches the firewall and the firewall compare it to the security policy to determine whether the packet IS authorized.

So normally security policy should examine pré-nat zones and not post-NAT zones isn't it?

Thank you

Re: Nat

TomYoung — Wed, 31 Jul 2024 16:06:42 GMT

Hi @Sarou22 ,

You are correct that the incoming packet is destined for a pre-NAT zone.

To understand why you put the post-NAT zone in the security policy rule, we need to review the session setup process on the NGFW. I got this diagram from the PCNSE Study Guide.

The NGFW looks at NAT rules to determine the destination zone before checking the security policy. It is called a NAT lookup because NAT is not actually applied to the traffic yet. The NAT rule changes the IP address in the packet on egress. I like the behavior because the security policy shows the ultimate destination zone for the traffic. The rule of thumb to apply "pre-NAT IP and post-NAT everything else" to security policy rules works well for these scenarios.

Thanks,

Tom

Re: Nat

Sarou22 — Wed, 31 Jul 2024 21:52:07 GMT

Hello,

Sorry it IS not clear to me.

My exemple IS the following:

Source zone : outside

Destination zone : inside

Source adress:8.8.8.8

Destination adress: 212.21.20.4

Nat rules: 212.21.20.4 translated to 10.118.20.3

So when the server 8.8.8.8 ping the user 212.21.20.4 thé firewall will translate 212.21.20.4 to

The firewall will examine post nat zone, zone inside?

Re: Nat

TomYoung — Wed, 31 Jul 2024 22:08:20 GMT

Hi @Sarou22 ,

If you have an inbound destination NAT rule, here is a great article with example NAT and security policy rules on the bottom.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/nat/nat-configuration-examples/destination-nat-exampleone-to-one-mapping

Thanks!

Tom