I had a quick question about destination NATing to an address not in the same subnet as an interface on the Palo Alto. For example, let's say I have a site-to-site VPN and I am using destination NAT on one side of the tunnel. When traffic comes from one side of the tunnel to the other, destination NAT is performed. One side uses 10.124.4.50/24 as its destination. The firewall on the other side then uses destination NAT to translate this traffic to 10.1.1.50/24. I have seen articles on the Palo website that say you must have a route for this NAT address or have an interface with an IP in that subnet assigned.
I have done destination NAT a number of times to public address spaces to a subnet that did not physically belong to an interface on the Palo. For example, the public address of the Palo is 220.127.116.11 and I am destination NATing a server from 18.104.22.168 to 192.168.50.250. In these cases, I never created a route manually for the before-NAT address/subnet. Is this something that has changed with recent PAN-OS codes?
I ask because I came across a situation similar to what I described above with a VPN tunnel. The other side of the tunnel needed a route for the subnet they were NATing to/from in order for the policy to work. I never had to do this in the cases I have seen, so I am curious why.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!