topic Re: nat translation in General Topics https://live.paloaltonetworks.com/t5/general-topics/nat-translation/m-p/2528#M1882 <HTML><HEAD></HEAD><BODY><P>Hello Salahuddin,</P><P></P><P>With the help of &gt;test NAT policy<SPAN class="GINGER_SOFTWARE_mark"> ...........</SPAN>&nbsp; <SPAN class="GINGER_SOFTWARE_mark">command</SPAN>, you will be able to veri<SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark">fy configure</SPAN></SPAN>d <SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark">NAT pol</SPAN></SPAN>icy on the PAN firewall. But, if you have an existing session on the PAN firewall and you want to identify, packet is <SPAN class="GINGER_SOFTWARE_mark">executing</SPAN> by&nbsp; which NAT policy, then apply CLI command&nbsp; &gt;<SPAN style="color: #3b3b3b; font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;">show session all filter source &lt;source IP&gt; destination &lt;destination IP<SPAN class="GINGER_SOFTWARE_mark">&gt;.</SPAN> This command will give you an ID.</SPAN></P><P></P><P>&gt;<SPAN class="GINGER_SOFTWARE_mark">show</SPAN> session ID XYZ&nbsp; &gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt; This command output will show in detail information i.e NAT-policy name, security policy name, PBF, Source interface, destination interface etc. </P><P></P><P>For an example:</P><P>admin@DADA&gt; show session all filter source 192.168.2.29 destination 69.171.245.49</P><P></P><P></P><P>--------------------------------------------------------------------------------</P><P>ID&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Application&nbsp;&nbsp;&nbsp; State&nbsp;&nbsp; Type Flag&nbsp; Src<SPAN class="GINGER_SOFTWARE_mark">[</SPAN>Sport<SPAN class="GINGER_SOFTWARE_mark">]</SPAN>/Zone/Proto (translated IP<SPAN class="GINGER_SOFTWARE_mark">[</SPAN>Port])</P><P><SPAN class="GINGER_SOFTWARE_mark">Vsys</SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">Dst</SPAN><SPAN class="GINGER_SOFTWARE_mark">[</SPAN><SPAN class="GINGER_SOFTWARE_mark">Dport</SPAN><SPAN class="GINGER_SOFTWARE_mark">]</SPAN>/Zone (translated IP<SPAN class="GINGER_SOFTWARE_mark">[</SPAN>Port])</P><P>--------------------------------------------------------------------------------</P><P>1690&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">facebook</SPAN>-base&nbsp; ACTIVE&nbsp; FLOW&nbsp; NS&nbsp;&nbsp; 192.168.2.29<SPAN class="GINGER_SOFTWARE_mark">[</SPAN>49365<SPAN class="GINGER_SOFTWARE_mark">]</SPAN>/Trust-LAN/6&nbsp; (192.168.1.75<SPAN class="GINGER_SOFTWARE_mark">[</SPAN>19914])</P><P>vsys1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 69.171.245.49<SPAN class="GINGER_SOFTWARE_mark">[</SPAN>443<SPAN class="GINGER_SOFTWARE_mark">]</SPAN>/Untrust-ISP&nbsp; (69.171.245.49<SPAN class="GINGER_SOFTWARE_mark">[</SPAN>443])</P><P>admin@DADA&gt; show session id 1690</P><P><SPAN style="font-size: 10pt; line-height: 1.5em;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; c2s flow: -------------------------&gt; Client to<SPAN class="GINGER_SOFTWARE_mark"> Ser</SPAN>ver <SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark">flow</SPAN></SPAN></SPAN></SPAN></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">source</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.2.29 [Trust<SPAN class="GINGER_SOFTWARE_mark">-LAN] --</SPAN>--<SPAN class="GINGER_SOFTWARE_mark">----&gt; </SPAN><SPAN class="GINGER_SOFTWARE_mark">So</SPAN><SPAN class="GINGER_SOFTWARE_mark">urceIP</SPAN>/ <SPAN class="GINGER_SOFTWARE_mark">security</SPAN> Zone</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">dst</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 69.171.245.49 ---------------&gt; Destination IP</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">proto</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">sport</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 49365&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">dport</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 443 ----------------&gt; Port</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">state</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACTIVE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; FLOW</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">src</SPAN> user:&nbsp;&nbsp;&nbsp; unknown</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">dst</SPAN> user:&nbsp;&nbsp;&nbsp; unknown</P><P></P><P></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; s2c flow: ------------------&gt; Server to client flow.</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">source</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 69.171.245.49 [Untrust-ISP]</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">dst</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.75</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">proto</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">sport</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 443&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">dport</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 19914</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">state</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACTIVE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; FLOW</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">src</SPAN> user:&nbsp;&nbsp;&nbsp; unknown</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">dst</SPAN> user:&nbsp;&nbsp;&nbsp; unknown</P><P></P><P></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">start</SPAN> time<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> Thu Jul&nbsp; 3 02:21:24 2014</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">timeout</SPAN><SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> 3600 <SPAN class="GINGER_SOFTWARE_mark">sec</SPAN></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">time</SPAN> to live<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> 3161 <SPAN class="GINGER_SOFTWARE_mark">sec</SPAN></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">total</SPAN> byte count<SPAN class="GINGER_SOFTWARE_mark">(</SPAN>c2s)<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> 9640</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">total</SPAN> byte count<SPAN class="GINGER_SOFTWARE_mark">(</SPAN>s2c)<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> 11932</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; layer7 packet count<SPAN class="GINGER_SOFTWARE_mark">(</SPAN>c2s)<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> 94</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; layer7 packet count<SPAN class="GINGER_SOFTWARE_mark">(</SPAN>s2c)<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> 93</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">vsys</SPAN><SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> vsys1</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">application</SPAN><SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> <SPAN class="GINGER_SOFTWARE_mark">facebook</SPAN>-base</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">rule</SPAN><SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> LAN-ISP --------------------&gt; Security rule</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">session</SPAN> to be logged at <SPAN class="GINGER_SOFTWARE_mark">end</SPAN><SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp; :</SPAN> True</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">session</SPAN> in session ager<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> True</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">session</SPAN> synced from HA peer<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp; :</SPAN> False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">address</SPAN>/port translation<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> source + destination</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">nat</SPAN>-rule<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> Source-NAT<SPAN class="GINGER_SOFTWARE_mark">(</SPAN>vsys1)&nbsp; ------------------&gt; NAT rule name</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; layer7 processing<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> completed</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; URL filtering enabled<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> True</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; URL category<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> social-networking</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">session</SPAN> via <SPAN class="GINGER_SOFTWARE_mark">syn</SPAN>-cookies<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">session</SPAN> terminated on host<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp; :</SPAN> False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">session</SPAN> traverses tunnel<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">captive</SPAN> portal session<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">ingress</SPAN> interface<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> ethernet1/2 ----------&gt; Incoming interface</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">egress</SPAN> interface<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> ethernet1/1 ----------&gt; Outgoing interface</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">session</SPAN> QoS rule<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> N/A (class 4)</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">tracker</SPAN> stage l7proc<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> <SPAN class="GINGER_SOFTWARE_mark">ctd</SPAN> decoder bypass</P><P></P><P></P><P>Hope this helps.</P><P></P><P>Thanks</P></BODY></HTML> Thu, 03 Jul 2014 13:54:33 GMT HULK 2014-07-03T13:54:33Z nat translation https://live.paloaltonetworks.com/t5/general-topics/nat-translation/m-p/2525#M1879 <HTML><HEAD></HEAD><BODY><P>How to check and verify NAT translation using CLI.</P></BODY></HTML> Thu, 03 Jul 2014 08:59:34 GMT https://live.paloaltonetworks.com/t5/general-topics/nat-translation/m-p/2525#M1879 Salahuddin 2014-07-03T08:59:34Z Re: nat translation https://live.paloaltonetworks.com/t5/general-topics/nat-translation/m-p/2526#M1880 <HTML><HEAD></HEAD><BODY><P>First find out relevant sessino:</P><P>&nbsp;&nbsp; show session all filter source &lt;source IP&gt; destination &lt;destination IP&gt;</P><P></P><P>Now following command will give NAT details, carefully analyse the output</P><P>&nbsp;&nbsp; show session id &lt;ID-from above command&gt;</P></BODY></HTML> Thu, 03 Jul 2014 11:02:09 GMT https://live.paloaltonetworks.com/t5/general-topics/nat-translation/m-p/2526#M1880 hshah 2014-07-03T11:02:09Z Re: nat translation https://live.paloaltonetworks.com/t5/general-topics/nat-translation/m-p/2527#M1881 <HTML><HEAD></HEAD><BODY><P>You can simulate a Packet with:</P><P></P><P>&gt; test nat-policy-match .........</P><P></P><P>Regards</P><P>Marco</P></BODY></HTML> Thu, 03 Jul 2014 12:45:48 GMT https://live.paloaltonetworks.com/t5/general-topics/nat-translation/m-p/2527#M1881 MarcoLeckel 2014-07-03T12:45:48Z Re: nat translation https://live.paloaltonetworks.com/t5/general-topics/nat-translation/m-p/2528#M1882 <HTML><HEAD></HEAD><BODY><P>Hello Salahuddin,</P><P></P><P>With the help of &gt;test NAT policy<SPAN class="GINGER_SOFTWARE_mark"> ...........</SPAN>&nbsp; <SPAN class="GINGER_SOFTWARE_mark">command</SPAN>, you will be able to veri<SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark">fy configure</SPAN></SPAN>d <SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark">NAT pol</SPAN></SPAN>icy on the PAN firewall. But, if you have an existing session on the PAN firewall and you want to identify, packet is <SPAN class="GINGER_SOFTWARE_mark">executing</SPAN> by&nbsp; which NAT policy, then apply CLI command&nbsp; &gt;<SPAN style="color: #3b3b3b; font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;">show session all filter source &lt;source IP&gt; destination &lt;destination IP<SPAN class="GINGER_SOFTWARE_mark">&gt;.</SPAN> This command will give you an ID.</SPAN></P><P></P><P>&gt;<SPAN class="GINGER_SOFTWARE_mark">show</SPAN> session ID XYZ&nbsp; &gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt; This command output will show in detail information i.e NAT-policy name, security policy name, PBF, Source interface, destination interface etc. </P><P></P><P>For an example:</P><P>admin@DADA&gt; show session all filter source 192.168.2.29 destination 69.171.245.49</P><P></P><P></P><P>--------------------------------------------------------------------------------</P><P>ID&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Application&nbsp;&nbsp;&nbsp; State&nbsp;&nbsp; Type Flag&nbsp; Src<SPAN class="GINGER_SOFTWARE_mark">[</SPAN>Sport<SPAN class="GINGER_SOFTWARE_mark">]</SPAN>/Zone/Proto (translated IP<SPAN class="GINGER_SOFTWARE_mark">[</SPAN>Port])</P><P><SPAN class="GINGER_SOFTWARE_mark">Vsys</SPAN>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">Dst</SPAN><SPAN class="GINGER_SOFTWARE_mark">[</SPAN><SPAN class="GINGER_SOFTWARE_mark">Dport</SPAN><SPAN class="GINGER_SOFTWARE_mark">]</SPAN>/Zone (translated IP<SPAN class="GINGER_SOFTWARE_mark">[</SPAN>Port])</P><P>--------------------------------------------------------------------------------</P><P>1690&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">facebook</SPAN>-base&nbsp; ACTIVE&nbsp; FLOW&nbsp; NS&nbsp;&nbsp; 192.168.2.29<SPAN class="GINGER_SOFTWARE_mark">[</SPAN>49365<SPAN class="GINGER_SOFTWARE_mark">]</SPAN>/Trust-LAN/6&nbsp; (192.168.1.75<SPAN class="GINGER_SOFTWARE_mark">[</SPAN>19914])</P><P>vsys1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 69.171.245.49<SPAN class="GINGER_SOFTWARE_mark">[</SPAN>443<SPAN class="GINGER_SOFTWARE_mark">]</SPAN>/Untrust-ISP&nbsp; (69.171.245.49<SPAN class="GINGER_SOFTWARE_mark">[</SPAN>443])</P><P>admin@DADA&gt; show session id 1690</P><P><SPAN style="font-size: 10pt; line-height: 1.5em;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; c2s flow: -------------------------&gt; Client to<SPAN class="GINGER_SOFTWARE_mark"> Ser</SPAN>ver <SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark"><SPAN class="GINGER_SOFTWARE_mark">flow</SPAN></SPAN></SPAN></SPAN></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">source</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.2.29 [Trust<SPAN class="GINGER_SOFTWARE_mark">-LAN] --</SPAN>--<SPAN class="GINGER_SOFTWARE_mark">----&gt; </SPAN><SPAN class="GINGER_SOFTWARE_mark">So</SPAN><SPAN class="GINGER_SOFTWARE_mark">urceIP</SPAN>/ <SPAN class="GINGER_SOFTWARE_mark">security</SPAN> Zone</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">dst</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 69.171.245.49 ---------------&gt; Destination IP</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">proto</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">sport</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 49365&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">dport</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 443 ----------------&gt; Port</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">state</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACTIVE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; FLOW</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">src</SPAN> user:&nbsp;&nbsp;&nbsp; unknown</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">dst</SPAN> user:&nbsp;&nbsp;&nbsp; unknown</P><P></P><P></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; s2c flow: ------------------&gt; Server to client flow.</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">source</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 69.171.245.49 [Untrust-ISP]</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">dst</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 192.168.1.75</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">proto</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">sport</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 443&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">dport</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 19914</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">state</SPAN>:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ACTIVE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; FLOW</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">src</SPAN> user:&nbsp;&nbsp;&nbsp; unknown</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">dst</SPAN> user:&nbsp;&nbsp;&nbsp; unknown</P><P></P><P></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">start</SPAN> time<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> Thu Jul&nbsp; 3 02:21:24 2014</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">timeout</SPAN><SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> 3600 <SPAN class="GINGER_SOFTWARE_mark">sec</SPAN></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">time</SPAN> to live<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> 3161 <SPAN class="GINGER_SOFTWARE_mark">sec</SPAN></P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">total</SPAN> byte count<SPAN class="GINGER_SOFTWARE_mark">(</SPAN>c2s)<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> 9640</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">total</SPAN> byte count<SPAN class="GINGER_SOFTWARE_mark">(</SPAN>s2c)<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> 11932</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; layer7 packet count<SPAN class="GINGER_SOFTWARE_mark">(</SPAN>c2s)<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> 94</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; layer7 packet count<SPAN class="GINGER_SOFTWARE_mark">(</SPAN>s2c)<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> 93</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">vsys</SPAN><SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> vsys1</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">application</SPAN><SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> <SPAN class="GINGER_SOFTWARE_mark">facebook</SPAN>-base</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">rule</SPAN><SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> LAN-ISP --------------------&gt; Security rule</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">session</SPAN> to be logged at <SPAN class="GINGER_SOFTWARE_mark">end</SPAN><SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp; :</SPAN> True</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">session</SPAN> in session ager<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> True</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">session</SPAN> synced from HA peer<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp; :</SPAN> False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">address</SPAN>/port translation<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> source + destination</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">nat</SPAN>-rule<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> Source-NAT<SPAN class="GINGER_SOFTWARE_mark">(</SPAN>vsys1)&nbsp; ------------------&gt; NAT rule name</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; layer7 processing<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> completed</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; URL filtering enabled<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> True</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; URL category<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> social-networking</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">session</SPAN> via <SPAN class="GINGER_SOFTWARE_mark">syn</SPAN>-cookies<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">session</SPAN> terminated on host<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp; :</SPAN> False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">session</SPAN> traverses tunnel<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">captive</SPAN> portal session<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> False</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">ingress</SPAN> interface<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> ethernet1/2 ----------&gt; Incoming interface</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">egress</SPAN> interface<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> ethernet1/1 ----------&gt; Outgoing interface</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">session</SPAN> QoS rule<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> N/A (class 4)</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN class="GINGER_SOFTWARE_mark">tracker</SPAN> stage l7proc<SPAN class="GINGER_SOFTWARE_mark">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :</SPAN> <SPAN class="GINGER_SOFTWARE_mark">ctd</SPAN> decoder bypass</P><P></P><P></P><P>Hope this helps.</P><P></P><P>Thanks</P></BODY></HTML> Thu, 03 Jul 2014 13:54:33 GMT https://live.paloaltonetworks.com/t5/general-topics/nat-translation/m-p/2528#M1882 HULK 2014-07-03T13:54:33Z Re: nat translation https://live.paloaltonetworks.com/t5/general-topics/nat-translation/m-p/2529#M1883 <HTML><HEAD></HEAD><BODY><P>You may also find this main documentation on nat operations helpful.</P><P></P><P><A href="https://live.paloaltonetworks.com/docs/DOC-1517">Understanding PAN-OS NAT</A></P></BODY></HTML> Fri, 04 Jul 2014 10:56:54 GMT https://live.paloaltonetworks.com/t5/general-topics/nat-translation/m-p/2529#M1883 pulukas 2014-07-04T10:56:54Z