topic Configure a static 1-to-1 destination NAT policy in General Topics

Configure a static 1-to-1 destination NAT policy

lzabler — Sat, 11 Feb 2017 03:11:27 GMT

Hello Live Community,

I am a new comer to the firewall game and I am wondering how would I go about setting up static 1-to-1 destination NAT policy on my PA-500 Firewall. I just recently set up the firewall using the documentation below and everything seems to be running great but my Xbox One device Nat is set to strict. I was wondering if someone could help me understand or show me a good example on how I could change that to open? I have read some great articles but still not fully understanding. Any help would be greatly appreciated!

Initial Firewall Setup:

https://live.paloaltonetworks.com/t5/Configuration-Articles/Setting-Up-the-PA-200-for-Home-and-Small-Office/ta-p/61838

Articles read on NAT:

https://live.paloaltonetworks.com/t5/Management-Articles/Palo-Alto-Networks-Firewalls-gaming-consoles-xbox-Playstation/ta-p/54848

https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Understanding-PAN-OS-NAT/ta-p/60965

Thank you!

Luke

Re: Configure a static 1-to-1 destination NAT policy

TranceforLife — Sat, 11 Feb 2017 10:24:39 GMT

Hi Luke,

Below the answer:

https://live.paloaltonetworks.com/t5/General-Topics/Natting-issue-with-new-subnet/m-p/141806#U141806

Re: Configure a static 1-to-1 destination NAT policy

lzabler — Sat, 11 Feb 2017 15:42:39 GMT

TranceforLife,

Thank you for the information I think I am slowly getting it. Just a few questions.

In the link that you sent me I see that in the diagram in Pre-Nat they have the "destination address" set up as 195.51.100.22 however I do not see that IP address in the overall diagram so I assume that address is where he wants to connect to correct?

If so I assume I need to find out what Xbox Lives IP address is and enter that in there?

Thank you for all your help

Luke

Re: Configure a static 1-to-1 destination NAT policy

TranceforLife — Sun, 12 Feb 2017 11:25:01 GMT

Hi,

So you can create a static NAT entry to forward all external traffic destined to a particular public IP to the private IP of the console. So you need to know your external IP for this to work. However, l do recommend to use DDNS for this to work better in case your external IP changed. So in the policy, you simply can put DNS name as a destination same as for nat config. More about DDNS.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-and-Test-FQDN-Objects/ta-p/61903

https://www.changeip.com/