topic Re: Security policy and NAT - zone direction in General Topics

Security policy and NAT - zone direction

ghostrider — Fri, 28 Oct 2016 13:57:43 GMT

Hello Experts

When I confiugre the NAT and associated security policy then I always confuse about the direction of zones. As I understand NAT zones are always determined by ingress interface zone (source zone) and route lookup gives the outoing interface zone (destination zone) but my question is when we confiugre the associated security policy then zones direction would be post-nat address zones or pre-nat address zones?

Re: Security policy and NAT - zone direction

ghostrider — Sat, 29 Oct 2016 15:23:25 GMT

Hello

Is there any one?

Re: Security policy and NAT - zone direction

rmonvon — Tue, 01 Nov 2016 14:51:06 GMT

Hi...The security rule is post-NAT so you should use the zones where the actual client/server lives. Here's a NAT doc for reference:

https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Understanding-PAN-OS-NAT/ta-p/60965?attachment-id=1707

The way I use to remember which zone to use for NAT is:

- write the security & NAT rule using the zones where the client & server actually live.

- If this is a dest NAT, then use the zone of the actual client as the source & dest zones in the NAT rule only, not security rule. Security rule will stay the same as described in previous step

Re: Security policy and NAT - zone direction

TranceforLife — Tue, 01 Nov 2016 15:39:58 GMT

This video helped me to understood the NAT config:

https://www.youtube.com/watch?v=aVXzzZEgIA4

Re: Security policy and NAT - zone direction

ghostrider — Sat, 05 Nov 2016 19:04:15 GMT

thanks But I am not able to understand that destination NAT happens before security policy so in security policy, we should use the post-nated address (private address) but we use the original public address?