BI- DIRECTINAL NAT IN PALO ALTO

Reply
L1 Bithead

BI- DIRECTINAL NAT IN PALO ALTO

BI- DIRECTINAL NAT IN PALO ALTO

 

Go to Policies > NAT > Add

Create a NAT Rule:

  1. Name the rule as per your convivence.
  2. Select the source zone as LAN
  3. Destination zone as WAN
  4. Interface as the WAN (exit interface)
  5. Service as the preferred port.
  6. Source ip address as the internal LAN IP.
  7. Destination ip address as any.
  8. Now in translated packet, Select Static Ip in source translation and use the Public IP you wish to have.
  9. Make sure you enable bi-directional.

 

Go to Policies > Security > Add

Create a Security Rule:

  1. Name the rule.
  2. Select Source as LAN and WAN
  3. Select Destination as WAN and LAN
  4. Source address as any
  5. Destination address as the public ip

Commit the changes and test the rule. Also take care of the rule priority and placement of the rules.

Community Team Member

Re: BI- DIRECTINAL NAT IN PALO ALTO

Thanks @Aashish74  for this. This can be good for people wanting some basics.  

Soon, we may have additional tools like Iron Skillets that can help accomplish things like this.

 

For anyone who wants to know more about Iron Skillets, please look at these blogs:

https://live.paloaltonetworks.com/t5/Blogs/Getting-Started-with-IronSkillet-Best-Practices-Templates...

 

Also there is information about Expedition here that will work with Iron Skillet.

https://live.paloaltonetworks.com/t5/Expedition-Articles/Expedition-The-Glue-Between-IronSkillet-and...

Stay Secure,
Joe
End of line
Highlighted
L4 Transporter

Re: BI- DIRECTINAL NAT IN PALO ALTO

@Aashish74 

Although in general this may work, there are a few points in the workflow that are not quite a best practice and can be misleading.

Bi-directional is generally not recommended as you don’t have full control of the return traffic. Packets will be translated correctly from LAN to WAN, but in the opposite direction, they will match any zone to WAN , which could complicate things if you have multiple zones.

I would always recommend having specific inbound destination NAT rule to your servers and a generic source NAT outbound if your servers need to connect to Internet.

The second point is that you suggest adding a service to the bidirectional NAT rule, which means that the rule will match only this service port for both the  inbound and outbound translation. This kind of defeats the purpose of bi-direction, as you presumably want to configure it for outbound internet traffic for your server.

Next, your security rule will match the inbound packets to the server, but not outbound from the server.

Finally it is not a good practice to configure the same multiple zones in source and destination.

L1 Bithead

Re: BI- DIRECTINAL NAT IN PALO ALTO

@BatD  Thanks for the details and insight provided !!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!