topic Re: One to one NAT mapping for many to many in General Topics

One to one NAT mapping for many to many

MarioMarquez — Wed, 20 Mar 2019 19:53:45 GMT

Sonicwalls have a setting that allow a /24 subnet being natted to a different /24 subnet to get mapped on a one to one basis.

Example, 192.168.1.10 will get bidirectionally natted to 10.0.0.10, 192.168.1.11 will get bidirectionally natted to 10.0.0.11, etc...

The last octet will always stay the same which allows one nat rule to be added so both sides can initiate connections. Is there a way to do this on the Palo without doing a static one to one nat for each mapping?

Re: One to one NAT mapping for many to many

reaper — Thu, 21 Mar 2019 10:45:10 GMT

dynamic NAT does this also, but only for one subnet to another subnet, not for a bunch of random subnets based on the last octet only

ie: dynamic nat 192.168.0.3/24 will translate to 10.0.0.3/24

Re: One to one NAT mapping for many to many

MarioMarquez — Wed, 10 Apr 2019 03:54:52 GMT

Is there a specific setting to enable for it to work this way? I have a vendor that needs to initiate from their side of a VPN tunnel to my side and dynamic NAT worked when we tested but only from my side to theirs. I needed to do a one to one static for them to initiate to my side successfully.

Re: One to one NAT mapping for many to many

reaper — Wed, 10 Apr 2019 05:14:58 GMT

are there overlapping IP addresses?

if both sides of the tunnel do dynamic nat, this would work

if there's no overlap you'd just need a policy in each direction that applies dynamic source nat

could you sketch the environment?

Re: One to one NAT mapping for many to many

MarioMarquez — Wed, 10 Apr 2019 11:54:03 GMT

Here is what's happening....

192.168.1.0/24 (real local subnet) gets translated to 10.222.224.0/24 when going to 10.240.0.0/22 (destination on other side of tunnel).
This currently works but I need to find a way for 10.222.224.10 to Nat to 192.168.1.10 so that the last octet (.10) is always natting to the same IP (.10) on both networks for every IP address.

10.222.224.11 needs to Nat to 192.168.1.11
10.222.224.12 needs to Nat to 192.168.1.12
10.222.224.13 needs to Nat to 192.168.1.13
10.222.224.14 needs to Nat to 192.168.1.14

The last octet on both /24 subnets needs to Nat to the same number bidirectionally since both sides of the tunnel need to initiate TCP connections.

Does this make sense?