topic Re: Destination NAT vs Source NAT with Bi-directional option in General Topics

Destination NAT vs Source NAT with Bi-directional option

harshaabba — Sun, 15 Jan 2017 02:06:46 GMT

Hi All,

In enterprise network, what are the usage scenarios for Destination NAT and Source NAT with Bi-directional option enable ?

Cheers

Harsha

Re: Destination NAT vs Source NAT with Bi-directional option

TranceforLife — Sun, 15 Jan 2017 07:55:25 GMT

Hi,

Very good explanation here:

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/networking/nat-configuration-examples

https://www.youtube.com/watch?v=aVXzzZEgIA4

Doesn't matter enterprise or home network NAT still the same:

Source NAT translates your source IP to a different one

Destination NAT translate your destination IP (one use of for enabling access to your internal servers from Internet)

Bi-directional really same as above, means by ticking the box you will create implicit Destination NAT policy. GUI will only show you that it is bidirectional but CLI will display the same rule as two separate (Source and Destination):

> show running nat-policy

Thx,

Myky

Re: Destination NAT vs Source NAT with Bi-directional option

reaper — Mon, 16 Jan 2017 08:50:51 GMT

Here's a video where I explain several scenarios : Tutorial: Network Address Translation

There is only one configuration method allowed where the bi-directional option is supported, and that is for source nat (bi-directional cannot be enabled when destination NAT is configured because the bi-directional option needs to be able to set the destination option in the implied reverse policy

if for example the configured rule is like this:

the bi-directional option will create an implied rule that sets destination translation for IP 2.2.2.2 if the original packet is headed toward 10.0.0.1 coming from the remote zone

hope this helps

Tom

Re: Destination NAT vs Source NAT with Bi-directional option

harshaabba — Fri, 20 Jan 2017 02:32:09 GMT

Hi All,

Thanks a lot for all the explanations.