topic Re: Destination NAT for mutilple of ports in a single NAT rule in General Topics

Destination NAT for mutilple of ports in a single NAT rule

JohnTang — Tue, 08 May 2018 06:50:41 GMT

So there will be a range of ports that need to be NATTED, but on the GUI, I can only specify a single port.

Can anyone tell me if this will work if I leave the port empty like below:

set service-group "Veeam Management" members [ "Veeam 2500-2600" "Veeam 9292-9293" ]

set rulebase nat rules "NAT Veeam Backup Server" to outside
set rulebase nat rules "NAT Veeam Backup Server" destination-translation translated-address "Veeam Backup Server"
set rulebase nat rules "NAT Veeam Backup Server" from outside
set rulebase nat rules "NAT Veeam Backup Server" source any
set rulebase nat rules "NAT Veeam Backup Server" destination WAN-IP
set rulebase nat rules "NAT Veeam Backup Server" service "Veeam Management"

Re: Destination NAT for mutilple of ports in a single NAT rule

BPry — Tue, 08 May 2018 12:41:47 GMT

CLI would likely be able to let you configure it but the commit validation is going to fail.

Re: Destination NAT for mutilple of ports in a single NAT rule

OtakarKlier — Tue, 08 May 2018 17:14:32 GMT

Hello,

Is this an inbound NAT or outbound NAT? For either I try to keep ports out of the NAT rule and let the Policies handle which ports/applications are allowed in/out.

Regards,

Re: Destination NAT for mutilple of ports in a single NAT rule

pulukas — Tue, 08 May 2018 22:45:50 GMT

It looks like you are setting up inbound destination NAT towards the server. If so, when you create that rule in the GUI you can specify those original packet tab ports as ranges when you create the new services.

This will then do standard port forwarding where they same ip address could also be used on different ports for other servers.

Re: Destination NAT for mutilple of ports in a single NAT rule

JohnTang — Wed, 09 May 2018 00:59:21 GMT

Thanks for confirming, I think it would be more intuitive if PA can allow to specify multiple ports in the destination NAT section like a lot of other vendors do.

Re: Destination NAT for mutilple of ports in a single NAT rule

pulukas — Thu, 10 May 2018 23:31:45 GMT

The service creation window does allow the creation of multiple ports and port ranges.

Re: Destination NAT for mutilple of ports in a single NAT rule

JohnTang — Fri, 11 May 2018 01:40:22 GMT

but the destination translated port can only be specified with a single port.

the intention is to translate a range of ports.

Re: Destination NAT for mutilple of ports in a single NAT rule

BPry — Fri, 11 May 2018 03:00:43 GMT

@JohnTang,

That's what I was trying to say with my original post, and maybe I should have taken more time with it. You can't have multiple destination address translations going to a port range on a NAT statement. Likewise you can't use a service group or anything of the like for the actual translated port.