Bi-Directional NAT To External IP not Configured on an Interface

[JoeJackson]

Hey All,

Working on a PA-220 on 10.0.6 here. I am trying to configure a BI-DI NAT for inside Zone A host 10.0.0.4 to Zone B public IP: 5.183.105.227. This traffic is to allow a vendor to build an IPSec VPN tunnel between their VPN appliance configured as 10.0.0.4 to their remote peer VPN of 99.169.208.245.

Zone A = Inside (Interface 1/6: 10.0.0.1/24)

Zone B = Internet (Interface 1/1 5.183.105.229/29)

NAT is setup as:

Source Zone: A ---> Destination Zone: B, Destination Interface 1/1

Source Address: 10.0.0.4

Service Any

Source Translation: Static-IP 5.183.105.227

Bi-Di = Yes

Destination translation = Unconfigured.

I have unrestricted security rules to allow traffic from Zone A to Zone B and from Zone B to Zone A.

What I have been able to conclude when I look at the packet captures for this traffic is that there is never a transmit capture created but I do see in the Drop capture where 10.0.0.4 is attempting to communicate with 99.169.208.245 via ISAKMP 500 but it is dropped before getting routed. 

Since the IP (5.183.105.227) that i am trying to source NAT to is not configured on any interface, is there some sort of trickery to make it work with a PA?

I cannot get this to work and spent 3 hours on the phone with PA support to no avail.

[OtakarKlier]

Hello,

Not sure on their VPN technology, however when I had to setup a tunnel between two PAN's where one was on the inside and already NAT'd. I had to use Peer Identifiers. So on the non-nated PAN, for the IKE tunnel, I had to use the Peer Identification option. 

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/vpns/set-up-site-to-site-vpn/set-up-an-ik...

Hope that helps.