BI- DIRECTINAL NAT IN PALO ALTO

[Aashish74]

BI- DIRECTINAL NAT IN PALO ALTO

Go to Policies > NAT > Add

Create a NAT Rule:

1. Name the rule as per your convivence.
2. Select the source zone as LAN
3. Destination zone as WAN
4. Interface as the WAN (exit interface)
5. Service as the preferred port.
6. Source ip address as the internal LAN IP.
7. Destination ip address as any.
8. Now in translated packet, Select Static Ip in source translation and use the Public IP you wish to have.
9. Make sure you enable bi-directional.

Go to Policies > Security > Add

Create a Security Rule:

1. Name the rule.
2. Select Source as LAN and WAN
3. Select Destination as WAN and LAN
4. Source address as any
5. Destination address as the public ip

Commit the changes and test the rule. Also take care of the rule priority and placement of the rules.

[jdelio]

Thanks @Aashish74  for this. This can be good for people wanting some basics.  

Soon, we may have additional tools like Iron Skillets that can help accomplish things like this.

For anyone who wants to know more about Iron Skillets, please look at these blogs:

https://live.paloaltonetworks.com/t5/Blogs/Getting-Started-with-IronSkillet-Best-Practices-Templates...

Also there is information about Expedition here that will work with Iron Skillet.

https://live.paloaltonetworks.com/t5/Expedition-Articles/Expedition-The-Glue-Between-IronSkillet-and...

[BatD]

@Aashish74 

Although in general this may work, there are a few points in the workflow that are not quite a best practice and can be misleading.

Bi-directional is generally not recommended as you don’t have full control of the return traffic. Packets will be translated correctly from LAN to WAN, but in the opposite direction, they will match any zone to WAN , which could complicate things if you have multiple zones.

I would always recommend having specific inbound destination NAT rule to your servers and a generic source NAT outbound if your servers need to connect to Internet.

The second point is that you suggest adding a service to the bidirectional NAT rule, which means that the rule will match only this service port for both the  inbound and outbound translation. This kind of defeats the purpose of bi-direction, as you presumably want to configure it for outbound internet traffic for your server.

Next, your security rule will match the inbound packets to the server, but not outbound from the server.

Finally it is not a good practice to configure the same multiple zones in source and destination.

[Aashish74]

@BatD  Thanks for the details and insight provided !!