Destination NAT Mismatch error

[smithkopel]

Hi I'm configuring a new PA-500 and have it working for source NAT going from Tusted to Internet. Now I want to create a destination NAT rule to allow traffic in to a web server located on the trusted net. I have created a rule almost exactly as it shows in the Admin guide but I'm getting the error - “nat rule “Incoming Web”: Mismatch destination address translation range” the settings are as follows:

Name: Incoming Web

Tag: None

Source Zone: Untrusted

Destination Zone: Untrusted

Destination Interface:  none (The manual shows ‘any’ but I don’t have that option)

Source Address: Any

Destination Address: External FW IP

Service: HTTP

Source Translation: None

Destination Translation: address: Internal Web Server IP

I can't seem to find anything on these forums relating to this error.

Any thoughts?

Thanks,

Kenton

[snisar]

Please select the interface where External FW IP is configured as "Destination Interface"

[smithkopel]

Thanks @snisar, I have already tried that (and tried again after your suggestion) but I still get the same error.

Kenton

[smithkopel]

It turns out this was due to a misconfiguration in the IP address of the target server.

[mikand]

Thanks for returning with followup of the result 🙂

[jeffrolc]

I am getting the same error but my public ip is dynamic.  The "Mismatch destination address translation range" goes away if I put a static ip address in the orginial packet, destination address field like you normally would but I need to leave this as any since it is dynamic.  Any Ideas?

[MP18]

@jeffrolc 

Please see this article.

Commit NAT Error: Mismatch of destination address translation range"" (paloaltonetworks.com)

and

Error message: “Mismatch of destination address translation ran... - Knowledge Base - Palo Alto Netw...

Regards