topic Re: STATIC NAT NOT WORKING in General Topics

STATIC NAT NOT WORKING

Him143u — Wed, 11 Jun 2025 18:50:59 GMT

Please consider below topology in which PC-1 - 3 are connected to Cisco Switch and having a gateway 192.168.1.1 configure on firewall. Firewall rule is any any and all the PC can ping the IT PC with actual IP. Now I want to deal with the scenario where all the PC-1 to 3 need to be statically translated to the IP in IT range which is 172.16.100.100 for PC-1 , 101 for PC-2 and 102 for PC-3 respectively but the scenario is not working. I would like to know how can we achieve this topolgy.

192.168.1.10 -- NAT TO -- 172.16.100.100

192.168.1.11 -- NAT TO -- 172.16.100.101

192.168.1.12 -- NAT TO -- 172.16.100.102

I tried doing static NAT as per below and it is working but I dont want to do that

192.168.1.10 -- NAT TO --172.16.1.3

Am I missing something like proxy arp.

Re: STATIC NAT NOT WORKING

reaper — Fri, 13 Jun 2025 09:52:14 GMT

you can't effectively nat for an IP subnet that is one hop away from the palo interface

outbound NAT will work, the palo will source nat outgoing packets, the next hop router will (probably, unless this router supports anti-spoofing) route the packet to the final destination

so far all will be good, but the reply packet will remain inside the local broadcast domain (the /24 subnet on the far end). the router will not know to forward that packet to 172.16.1.1 unless you set up some sort of proxy arp on the router

you can source nat behind 172.16.1.1 but not 172.16.100.x since that is one hop away

tl;dr you're performing an old-school spoofing attack

Re: STATIC NAT NOT WORKING

OtakarKlier — Fri, 13 Jun 2025 18:40:40 GMT

Hello,

I would keep it simple and just use security policies to allow/deny traffic. No need to nat between subnets.

Regards,