topic Re: WAN Failover NAT issue in General Topics

WAN Failover NAT issue

ClintL — Fri, 13 Jun 2014 17:21:18 GMT

Hello all,

I am trying to set up WAN failover on a Palo Alto PA-3020. I used the document at the bottom of this post. When I unplug the interface that is set up in the PBR, it switches over to the secondary ISP like it is supposed to. The problem is the Primary-NAT policy is still active so traffic doesn't pass because the Backup-NAT never takes effect. If I manually disable the Primary-NAT rule then I see traffic able to leave the Palo Alto. I noticed the document is for PANOS 3.1 but it doesn't look like much has changed as far as settings go. Does this setup still work for 6.0+? If so is there something I am missing so the Backup-NAT rule takes over? I didn't see anywhere that tells the NAT policies themselves to failover.

Dual ISP Branch Office Configuration

Re: WAN Failover NAT issue

Retired Member — Fri, 13 Jun 2014 17:25:59 GMT

could you please share your nat rules here

Re: WAN Failover NAT issue

ClintL — Fri, 13 Jun 2014 17:29:57 GMT

Sure. I basically set it up just like the document stated unless I missed something.

Re: WAN Failover NAT issue

Retired Member — Fri, 13 Jun 2014 17:31:55 GMT

you have to choose destination interface on Nat rules

This is because you hit always first rule.

Re: WAN Failover NAT issue

ClintL — Fri, 13 Jun 2014 17:39:12 GMT

That was it. Yeah I just missed that part in the document. Works like a charm now. Thanks panos!