topic Re: Unallowed to apply NAT rule in General Topics

Unallowed to apply NAT rule

Laurent_Dormond — Fri, 22 Mar 2019 09:59:24 GMT

Hello,

I'm trying to configure double NAT rule (SNAT + DNAT) using Panorama 8.1.4 managing PA 5220 devices running PanOS 8.0.14.

I can valid / commit configuration on Panorama, but when pushing config to devices I get following error message :

vsys -> vsys4 -> rulebase -> nat -> rules -> Exchange-vers-SMTP -> dynamic-destination-translation unexpected here
vsys -> vsys4 -> rulebase -> nat -> rules is invalid
Commit failed

Source Address translation : Dynamic IP -> one unique IP address

I tried to specify Dynamic IP and port instead, same error.

Destination Address translation : Dynamic IP (with session distribution) -> address group (2 IP addresses)

I tried to specify translated ports or leaving blank, same error.

Any idea ?

Regards,

Laurent

reaper — Fri, 22 Mar 2019 12:03:04 GMT

8.0 doesn't support dynamic destination NAT

If you need this functionality you will need to upgrade your firewalls to 8.1

Laurent_Dormond — Fri, 22 Mar 2019 12:47:05 GMT

Hi,

indeed, I tried to use static IP instead of Dynamic Ip (with session redistribution) for DNAT and it commits successfully.

Thanks for the info, also we need to upgrade our appliances to PanOS 8.1.

This is a case where managing the applicanes through Panorama in later release could lead to attempt to configure unsupported features...