topic Adding NAT rule order in Panorama cli in General Topics

Adding NAT rule order in Panorama cli

ixnneteng — Thu, 03 Nov 2016 13:55:17 GMT

Hi all,

I am looking to add around 60+ NAT rules for monitoring over IPsec that requires a policy NAT. I need to have them above another rule in the list for it to work. It is a very messy NAT list that I don't have the freedom to clean up. The NAT entries are being added to a device group in Panorama.

Thanks in advance,

Danny

Re: Adding NAT rule order in Panorama cli

hzayed — Thu, 03 Nov 2016 22:17:41 GMT

Hi Danny,

As I understand, in short, you want to add 60+ NAT rule to be above an existing rule.

If that is the situation, you can configure the new NAT rules, and after you are done, clone this existing NAT rule, you can choose to have the new cloned rule to be after any rule you specify. After you clone it, delete old one.

Hope this helps,

Haytham

Re: Adding NAT rule order in Panorama cli

BPry — Fri, 04 Nov 2016 14:31:41 GMT

That would be the proper way to do it. I don't believe that you can actually do this automatically in the CLI, it's something that you have to modify after.

I really wouldn't clone your existing rule and move it, just move the NAT rule that you need above the new ones.

Re: Adding NAT rule order in Panorama cli

RFalconer — Fri, 04 Nov 2016 21:27:12 GMT

You can re-order using the CLI but you can't create rules with sequence numbers to place them where you want in the policy. (That would be a nice feature)

So if you really wanted to get the rules in order as you go, you would have to use a 'move' command after creating each nat rule.

Maybe something like this, depending on what order you want things in.

set device-group <groupname> pre-rulebase nat rules NAT1 .......

move device-group <groupname> pre-rulebase nat rules NAT1 before CURRENTNAT (or you could use 'top' instead of 'before' if you want it first)

set device-group <groupname> pre-rulebase nat rules NAT2 .......

move device-group <groupname> pre-rulebase nat rules NAT2 before CURRENTNAT (or you could use 'after NAT1' if you want it beneath)