topic Re: IP address for NAT in General Topics

IP address for NAT

ghostrider — Sat, 29 Oct 2016 14:54:56 GMT

Hello Experts

I was checking confiugration on my PA firewall and I foud for every source and destination NAT, the public IP for NAT with /32 was assigned to external interface of firewall. In my opinion there is no need to assign public IP /32 to external interface of firewall? Can any body explain to me this

Re: IP address for NAT

pulukas — Sun, 30 Oct 2016 12:38:23 GMT

Palo Alto NAT rules will automatically create the proxy-arp if the address is withing the subnet range of your existing external interface. The address would not need to be added to the interface for this to work.

Re: IP address for NAT

ghostrider — Sat, 05 Nov 2016 19:10:45 GMT

thank you but what we need to do if public pool range isin different range than external interface subnet range? Firewall will also do the proxy-arp for this

Re: IP address for NAT

pulukas — Sun, 06 Nov 2016 11:42:05 GMT

If your ISP is routing the subnet to your PA interface as the next hop, then no proxy-arp will be needed.

If your ISP has added the second subnet to their interface and given you a second gateway address, then you need to add an address in this subnet and mask to your interface. Then the necessary proxy arp will be created when you add the NAT rules.