NAT Performance Issue

CafNetMatt — Mon, 11 Aug 2014 23:23:17 GMT

Hi All,

I recently migrated a client from a Fortinet firewall to a PANW. Most of the Virtual IPs from the Fortinet were migrated as bidirectional Source NATs.

One specific server had issues where outside traffic would intermittently not be able to connect with the server. I troubleshot the issue and couldn't find anything wrong with the NAT or anything else.

The client opened a ticket with PANW support. The support tech broke the bidirectional NAT into separate a SNAT and DNAT.

The DNAT is interesting in that the traffic from the outside is being SNAT'ed to the LAN interface on the firewall using dynamic-ip-and-port and then a destination translation to the inside server address with a port translation back to 443.

The SNAT is normal except is was also created using dynamic-ip-and-port to the server's public address.

here's the XML config for the DNAT:

<to>

<member>Outside</member>

</to>

<from>

<member>Outside</member>

</from>

</source>

<member>server-NAT</member>

</destination>

<nat-type>ipv4</nat-type>

<to-interface>any</to-interface>

<destination-translation>

<translated-address>server-inside</translated-address>

<translated-port>443</translated-port>

</destination-translation>

<source-translation>

<dynamic-ip-and-port>

<interface-address>

<interface>ethernet1/4</interface>

</interface-address>

</dynamic-ip-and-port>

</source-translation>

</entry>

This fixed the issue.

Can someone provide some insight as to why and what the issue actually was? I'd just like to know for the future. The support tech didn't provide the "why" to the client.

Gracias!

Re: NAT Performance Issue

SDorsey — Tue, 12 Aug 2014 02:24:43 GMT

I do not know the answer but can confirm I have seen this same behavior.

Re: NAT Performance Issue

CafNetMatt — Tue, 12 Aug 2014 05:00:42 GMT

At least I know I'm not going nuts or completely incompetent. :smileysilly:

topic Re: NAT Performance Issue in General Topics

NAT Performance Issue

Re: NAT Performance Issue

Re: NAT Performance Issue