topic PBF with NAT, how does it works? in General Topics

PBF with NAT, how does it works?

JTR — Fri, 06 Sep 2013 05:27:01 GMT

Hi Guys

According to document , if there's destination NAT , there'll be second routing lookup to decide outbound zone & interface. But I'm very confused when there's routing and PBF together, In the second routing lookup, how does PBF rule work? Does PBF work based on Pre-NAT destination address or Post-NAT destination address? According to document at the second lookup process works based on POST-NAT destination address, that means if the routing table works fine, it should follow routing table lookup result. But in my customers networks it doesn't look like that.. Using PBF and U-Turn NAT together is really kind of a mess.

Thank you very much.

Re: PBF with NAT, how does it works?

mikand — Fri, 06 Sep 2013 05:34:43 GMT

Would any of these docs be of any help?

Understanding PAN-OS NAT

https://live.paloaltonetworks.com/docs/DOC-1517

Packet Flow in PAN-OS

https://live.paloaltonetworks.com/docs/DOC-1628

Re: PBF with NAT, how does it works?

HULK — Fri, 06 Sep 2013 06:23:55 GMT

Hello,

PBF lookup happens in pre-NAT IP address. Also in PAN firewall NAT evaluate at first with original IP but Apply at the end of flow.

Packet flow on PAN firewall:-

Few more information regarding the same.

Fowarding

Testing Security, NAT and PBF Rules via the CLI

Inbound NAT Policy with Outbound PBF Causing IP-Spoofing Drops

NAT and Security Policies, PBF Failover and Symmetric Return - Dual ISP

Packet Flow in PAN-OS

Hope this helps.

Thanks

Re: PBF with NAT, how does it works?

JTR — Fri, 06 Sep 2013 07:05:48 GMT

Thanks a lot . I'll read these document. Hava a nice day!

Re: PBF with NAT, how does it works?

AGrijalba — Tue, 30 Apr 2024 15:02:27 GMT

Sorry to revive this 10 years later. Documentation is not specific enough for me. But in my experience:

If there is Dest NAT there will be a second routing lookup, that will include a second PBF lookup. To be clear, the moment there is Dest NAT it will ignore all previous PBF/routing lookups and evaluate both again.
The IP addresses used in the second routing/PBF lookup are: PRE-NAT source, and POST-NAT destination.

As I said, official documentation is quite good, but I missed those specific issues.