topic NAT rule being applied wrong in General Topics

NAT rule being applied wrong

SOC_CSG — Fri, 02 Oct 2015 09:12:18 GMT

Hi,

we have a static NAT from this ip 192.168.200.8 (zone DMZ) to 195.57. (zone VPN). But we realised that the NAT rule which is matching is wrong.

Its matching the NAT rule (ftp.arag.es) but this rule has a filter by "Destination zone" Externa. And the real traffic is VPN<->DMZ

Why PA is applying this rule if not being include the destiantion zone in the filter???

regards

OtakarKlier — Thu, 01 Oct 2015 14:13:27 GMT

Hello,

I'm guessing you need a U-Turn NAT rule so the VPN clients can communicate properly to the external FTP site.

This is a good article and covers all the NAT types.

Hope this helps!

glastra1 — Thu, 01 Oct 2015 19:30:19 GMT

when you create a bidirectional policy, a return policy is created in the background. You can see it just using the CLI

> show running nat-policy

The return policy changes the destination zone to any and put it as source. so In your case the return policy is going to be

From zone: any

To zone: DMZ

To: 192.57.58.218

Translate to: 192.168.200.8

Regards,

Gerardo