Destination NAT for mutilple of ports in a single NAT rule

[JohnTang]

So there will be a range of ports that need to be NATTED, but on the GUI, I can only specify a single port.

Can anyone tell me if this will work if I leave the port empty like below:

set service-group "Veeam Management" members [ "Veeam 2500-2600" "Veeam 9292-9293" ]

set rulebase nat rules "NAT Veeam Backup Server" to outside
set rulebase nat rules "NAT Veeam Backup Server" destination-translation translated-address "Veeam Backup Server"
set rulebase nat rules "NAT Veeam Backup Server" from outside
set rulebase nat rules "NAT Veeam Backup Server" source any
set rulebase nat rules "NAT Veeam Backup Server" destination WAN-IP
set rulebase nat rules "NAT Veeam Backup Server" service "Veeam Management"

[BPry]

CLI would likely be able to let you configure it but the commit validation is going to fail. 

[OtakarKlier]

Hello,

Is this an inbound NAT or outbound NAT? For either I try to keep ports out of the NAT rule and let the Policies handle which ports/applications are allowed in/out.

Regards,

[pulukas]

It looks like you are setting up inbound destination NAT towards the server.  If so, when you create that rule in the GUI you can specify those original packet tab ports as ranges when you create the new services.

This will then do standard port forwarding where they same ip address could also be used on different ports for other servers.

[JohnTang]

Thanks for confirming, I think it would be more intuitive if PA can allow to specify multiple ports in the destination NAT section like a lot of other vendors do.

[pulukas]

The service creation window does allow the creation of multiple ports and port ranges.

[JohnTang]

but the destination translated port can only be specified with a single port.

the intention is to translate a range of ports.

[BPry]

@JohnTang,

That's what I was trying to say with my original post, and maybe I should have taken more time with it. You can't have multiple destination address translations going to a port range on a NAT statement. Likewise you can't use a service group or anything of the like for the actual translated port.