topic Re: NAT question in General Topics

NAT question

stef — Sun, 07 Mar 2021 08:27:27 GMT

Hello all,

we have configuration with dual ISP.

From the 1st provider we get public IP directly on the PA

2nd provider is with nat, i mean on PA we have private IP.

When the route goes through the 1st one everything works fine.

When we switch to the 2nd one there is a problems . In the monitoring tab i can see all requests to Internet zone ends with "Incomplete, aged out".

Meanwhile we have IPSec's configured and they worked just fine from the both providers.

Can someone suggest what can be the problem?

Thank you in advance!

Re: NAT question

SutareMayur — Mon, 08 Mar 2021 06:30:48 GMT

Hi @stef ,

As it is showing the incomplete and you are facing problems to reach only the internet, you need to first verify the NAT configuration and check if Source NAT before going to ISP gateway is happening properly. Although the IPSEC is working fine through the circuit, re-verify the reverse path/routing config if it is clear. You need to have routes on the firewall to reach the backend hosts subnet who are sending the internet requests.

Re: NAT question

OtakarKlier — Mon, 08 Mar 2021 22:14:01 GMT

Hello,

I agree this sounds like a routing/NAT issue. Are you using PBF for the fail over? Or are both ISP's live at the same time and routing traffic?

Please advise,

Re: NAT question

stef — Tue, 09 Mar 2021 13:54:09 GMT

Hello

I dont use PBF. They are both up.

I have default routes with different Metrics

Re: NAT question

laurence64 — Tue, 09 Mar 2021 14:01:54 GMT

Just agreeing with everybody else really, it does sound like a NAT issue, I would make sure all routes and NAT's makes sense and then look further from there.

Re: NAT question

stef — Sun, 14 Mar 2021 14:37:08 GMT

Indeed it was routing issue.

I push the config from Panorama.

Nat policy changed to ISP2, but the default route remain the same because the Virtual router config was overwritten and the changes from panorama didnt applied .

Thank you all for your responses!