topic Re: Many-to-Many NAT (Both Direction) in General Topics

Many-to-Many NAT (Both Direction)

rthakker — Fri, 09 Apr 2021 13:01:53 GMT

Hi Everyone,

I am struggling to solve a problem NAT issue and need some help. I need to configure May-to-Many NAT on Palo Alto Firewall between two data centers. I have three /25 IPv4 subnets which needs to be mapped to three /25 subnets (subnet to subnet basis if not one to one IP basis) and three IPv6 /40 subnets needs same treatment. Traffic is expected to come from both direction inside to outside and outside to inside on specified TCP, UDP and ICMP ports. I have PA3220 which has been upgraded to PAN OS 9.0 and I will applicate if you can suggest best way to achieve this? Do I need to consider any resource limitation as I have three /25 IPv4 and three /40 IPv6 subnets which can overwhelm the resource?

Thanks

Re: Many-to-Many NAT (Both Direction)

OtakarKlier — Fri, 09 Apr 2021 15:00:15 GMT

Hello,

How are the two data centers connected? Just curious as to why you need the NAT?

Regards,

Re: Many-to-Many NAT (Both Direction)

rthakker — Fri, 09 Apr 2021 15:34:40 GMT

Yes they are connected but part of Migration work and removing Overlapping addresses requires NAT.

Re: Many-to-Many NAT (Both Direction)

OtakarKlier — Fri, 09 Apr 2021 15:44:01 GMT

Hello,

Please check out these articles and see if they help out.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLTlCAO

https://live.paloaltonetworks.com/t5/general-topics/overlapping-subnets-in-virtual-router-and-nat/m-p/199902#M59180

Regards,

Re: Many-to-Many NAT (Both Direction)

rthakker — Fri, 09 Apr 2021 15:53:00 GMT

Thank you for the prompt reply. I will check your suggested solution. In the meantime please could you tell me if it possible to solve by NAT or its impractical?

Re: Many-to-Many NAT (Both Direction)

OtakarKlier — Fri, 09 Apr 2021 15:55:04 GMT

While I have not had to do this. The articles go into this using NAT when you have the same subnets on the both sides.

Re: Many-to-Many NAT (Both Direction)

rthakker — Fri, 09 Apr 2021 16:07:05 GMT

I do have similar challenges due to migration work hence wanted to employ NAT as traffic is expected both ways between subnets hence NAT seems good option.

Re: Many-to-Many NAT (Both Direction)

rthakker — Sun, 11 Apr 2021 14:51:11 GMT

All,

I have noticed when Destination NAT configured for IPs which aren't configured on Firewall packets are being dropped so /25(IPv4) and /40(IPv6). If I add subnet as a Loopback interrace on firewall then NAT works. I tried using static discard route (Null route) but its not solving the issue. I am guessing its proxy-arp issue or is it something else? Any other way to solve the issue?

Re: Many-to-Many NAT (Both Direction)

Chris_Johnston — Mon, 12 Apr 2021 15:06:44 GMT

I would do this using several NAT rules (one for each subnet). See the third example on the static NAT section for use with subnets. (I have also configured and tested this in the past)

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/networking/nat/source-nat-and-destination-nat/destination-nat.html