topic Static bidirectional NAT or soruce/destination NAT in General Topics

Static bidirectional NAT or soruce/destination NAT

ghostrider — Sat, 29 Oct 2016 14:57:25 GMT

Hello Experts

Someone from PA told me that for public service like email server, where bidirectional NAT is required, it is best practice to use source NAT and destination NAT for the same public IP instead of using static NAT because static NAT will create the rule from every zone to server zone NAT. Can any body confirm this, really it is a best practice then why PA created the conecept of static NAT. Strange !

Re: Static bidirectional NAT or soruce/destination NAT

pulukas — Sun, 30 Oct 2016 12:42:21 GMT

NAT and security policy are completely separate in PanOS. Creating a static NAT rule will not permit any traffic by itself there needs to be a security policy to allow that connection to occur.

Here is the actual recommended NAT configuration guide. I see no mention of avoiding static NAT.

https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Understanding-PAN-OS-NAT/ta-p/60965

Re: Static bidirectional NAT or soruce/destination NAT

ghostrider — Sat, 05 Nov 2016 19:11:47 GMT

thank you