Bi-Directional NAT To External IP not Configured on an Interface

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Bi-Directional NAT To External IP not Configured on an Interface

L1 Bithead

Hey All,

Working on a PA-220 on 10.0.6 here. I am trying to configure a BI-DI NAT for inside Zone A host 10.0.0.4 to Zone B public IP: 5.183.105.227. This traffic is to allow a vendor to build an IPSec VPN tunnel between their VPN appliance configured as 10.0.0.4 to their remote peer VPN of 99.169.208.245.

 

Zone A = Inside (Interface 1/6: 10.0.0.1/24)

Zone B = Internet (Interface 1/1 5.183.105.229/29)

 

NAT is setup as:

Source Zone: A ---> Destination Zone: B, Destination Interface 1/1

Source Address: 10.0.0.4

Service Any

Source Translation: Static-IP 5.183.105.227

Bi-Di = Yes

Destination translation = Unconfigured.

 

I have unrestricted security rules to allow traffic from Zone A to Zone B and from Zone B to Zone A.

 

What I have been able to conclude when I look at the packet captures for this traffic is that there is never a transmit capture created but I do see in the Drop capture where 10.0.0.4 is attempting to communicate with 99.169.208.245 via ISAKMP 500 but it is dropped before getting routed. 

 

Since the IP (5.183.105.227) that i am trying to source NAT to is not configured on any interface, is there some sort of trickery to make it work with a PA?

 

I cannot get this to work and spent 3 hours on the phone with PA support to no avail.

1 REPLY 1

Cyber Elite
Cyber Elite

Hello,

Not sure on their VPN technology, however when I had to setup a tunnel between two PAN's where one was on the inside and already NAT'd. I had to use Peer Identifiers. So on the non-nated PAN, for the IKE tunnel, I had to use the Peer Identification option. 

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/vpns/set-up-site-to-site-vpn/set-up-an-ik...

 

Hope that helps.

  • 1768 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!