topic Re: NAT - with URL for NAT policy in General Topics

NAT - with URL for NAT policy

Jedi_D — Tue, 09 Apr 2019 10:00:31 GMT

Hello Folks,

I need some advice ....

I want to create a NAT rule to allow traffic to NOT be NATTED if it is going to a particular website.

e.g. if going to www.paloaltonetworks.com then dont NAT.

Is it possible to use URL objects for in a NAT policy??

Please could someone suggest how this can be done, or send me some useful links for doing this?

Thanks

Re: NAT - with URL for NAT policy

michaelbell — Tue, 09 Apr 2019 12:08:00 GMT

You can use fully qualified domain names as targets/source for your NAT rules e.g. google.com

You can't use HTTP urls e.g. www.google.com/examplepage as URL processing happens after NAT is completed.

Is that what you were after?

Re: NAT - with URL for NAT policy

jeremy.larsen — Tue, 09 Apr 2019 13:31:10 GMT

That is a particularly odd request. Do you mind me asking the what the use case is?

Re: NAT - with URL for NAT policy

Jedi_D — Tue, 09 Apr 2019 14:02:56 GMT

It's for a service that is available over leased line well as the internet. I want to use the leased line for these services instead of using the default NAT statement for the internet.

Re: NAT - with URL for NAT policy

jeremy.larsen — Tue, 09 Apr 2019 14:36:46 GMT

You could put the leased line in it's own zone and just exclude it from your NAT statements.

Example - (zones USERS, LEASED, INTERNET)

src USERS -> dst LEASED = NO NAT (this statement probably not necessary since it's already routed?)

src USERS -> dst INTERNET = NAT

Re: NAT - with URL for NAT policy

hshawn — Tue, 09 Apr 2019 15:28:36 GMT

If I understand what you are going for you may be able to use policy based forwarding to direct the traffic to the zone/interface of your choosing instead of out to the internet

Re: NAT - with URL for NAT policy

Jedi_D — Sat, 27 Apr 2019 21:54:06 GMT

Thanks, I simply created a new DMZ for the leased line