topic Re: BI- DIRECTINAL NAT IN PALO ALTO in General Topics

BI- DIRECTINAL NAT IN PALO ALTO

Aashish74 — Mon, 02 Dec 2019 15:08:42 GMT

BI- DIRECTINAL NAT IN PALO ALTO

Go to Policies > NAT > Add

Create a NAT Rule:

Name the rule as per your convivence.
Select the source zone as LAN
Destination zone as WAN
Interface as the WAN (exit interface)
Service as the preferred port.
Source ip address as the internal LAN IP.
Destination ip address as any.
Now in translated packet, Select Static Ip in source translation and use the Public IP you wish to have.
Make sure you enable bi-directional.

Go to Policies > Security > Add

Create a Security Rule:

Name the rule.
Select Source as LAN and WAN
Select Destination as WAN and LAN
Source address as any
Destination address as the public ip

Commit the changes and test the rule. Also take care of the rule priority and placement of the rules.

Re: BI- DIRECTINAL NAT IN PALO ALTO

jdelio — Tue, 03 Dec 2019 00:01:24 GMT

Thanks @Aashish74 for this. This can be good for people wanting some basics.

Soon, we may have additional tools like Iron Skillets that can help accomplish things like this.

For anyone who wants to know more about Iron Skillets, please look at these blogs:

https://live.paloaltonetworks.com/t5/Blogs/Getting-Started-with-IronSkillet-Best-Practices-Templates/ba-p/233175

Also there is information about Expedition here that will work with Iron Skillet.

https://live.paloaltonetworks.com/t5/Expedition-Articles/Expedition-The-Glue-Between-IronSkillet-and-Best-Practices/ta-p/255373

Re: BI- DIRECTINAL NAT IN PALO ALTO

BatD — Tue, 03 Dec 2019 14:15:56 GMT

@Aashish74

Although in general this may work, there are a few points in the workflow that are not quite a best practice and can be misleading.

Bi-directional is generally not recommended as you don’t have full control of the return traffic. Packets will be translated correctly from LAN to WAN, but in the opposite direction, they will match any zone to WAN , which could complicate things if you have multiple zones.

I would always recommend having specific inbound destination NAT rule to your servers and a generic source NAT outbound if your servers need to connect to Internet.

The second point is that you suggest adding a service to the bidirectional NAT rule, which means that the rule will match only this service port for both the inbound and outbound translation. This kind of defeats the purpose of bi-direction, as you presumably want to configure it for outbound internet traffic for your server.

Next, your security rule will match the inbound packets to the server, but not outbound from the server.

Finally it is not a good practice to configure the same multiple zones in source and destination.

Re: BI- DIRECTINAL NAT IN PALO ALTO

Aashish74 — Wed, 04 Dec 2019 05:03:15 GMT

@BatD Thanks for the details and insight provided !!