Configure NAT Policy for Exchange Server

[OliveIT]

We are brand new to Palo Alto and are configuring our first device, a PA-3020. We've been trying to configure a NAT policy that will direct inbound email to our Exchange server. Outbound email seems to work fine. Inbound email doesn't seem to be even hitting the firewall since there are no log entries. We have a Sonicwall firewall in place now and email works fine. When we move the cables from the Sonicwall to the PA-3020, inbound emails stop flowing. Any thoughts?

[hshah]

Hi Oliver,

Is it a Static NAT or just Destination NAT? Can you provide us snapshot of NAT configuration.

Regards,

Hardik Shah

[hshah]

Hi Oliver,

You can refer bellow mentioned video for DNAT.

Video Link : 1550

Regards,

Hardik Shah

[_slv_]

Hello

If You are new to PAN please read Understanding PAN-OS NAT first, and next  search this community for u-turn problems that could hit you

With regards

Slawek

[pulukas]

Sonicwall nat and policy organization is basically the same as you have in PanOS.  They are separate and require two rules.

Look at your Sonicwall nat rule for the inbound address to the exchange server.

Create this same rule in the nat section on the PA

In the security policy add a rule on the PA to permit the inbound smtp application to the exchange server.

Once you have both the nat rule and security policy the inbound traffic should flow.

[OliveIT · Accepted solution]

Thanks to everyone for your suggestions. Turns out we had it configured properly in the first place. The problem turned out to be the ARP table in the switch. The public facing IP had a MAC address pointing to the Sonicwall. When we moved the cables to the PA-3020, the switch was still trying to send the traffic to the Sonicwall. When we cleared the ARP table in the switch, traffic started flowing.