topic Re: Traffic is not getting Natted DIPP in General Topics

Traffic is not getting Natted DIPP

RakeshRanjan — Thu, 16 May 2019 10:55:59 GMT

We have Single Outbound PAT configured for internet traffic for all internal users.

So all users traffic use the same Outbound PAt while going to internet but one traffic is not getting natted with this NAT policy

There is no PBF configured, its simple NAT (Outbound PAT DIPP), Security Policy (From trust to untrust).

PAN-OS 8.1.6 h2

Request to fine suggestion on this.

Re: Traffic is not getting Natted DIPP

BPry — Thu, 16 May 2019 20:32:44 GMT

@RakeshRanjan,

Can you include the log showing that it isn't getting NAT'd and the NAT policy itself? For something like this the most common cause is that the traffic isn't actually matching the NAT policy itself, you could test this in the CLI by building out the 'test nat-policy-match' command to match the traffic that isn't hitting the NAT policy and verifying the firewall is matching the traffic to the policy correctly.

Re: Traffic is not getting Natted DIPP

RakeshRanjan — Thu, 16 May 2019 21:48:12 GMT

Thanks for your reply.

Same traffic getting natted some time and the some times its not.

Also the strange thing, when its getting natted ingress interface(E1/2) and egress interface(E1/1) is different as expected however when its not getting natted both ingress and egress interface are same.

Re: Traffic is not getting Natted DIPP

BPry — Fri, 17 May 2019 03:10:47 GMT

@RakeshRanjan ,

If the ingress and egress interfaces are changing then the traffic isn't the same. I haven't seen a PAN firewall mistake what interface traffic ingressed in years; so my initial reaction with this would be you have something improperly configured on your network causing unexpected routing.