Destination NAT to address not in same subnet

[LouisScaringella]

Hello,

I had a quick question about destination NATing to an address not in the same subnet as an interface on the Palo Alto. For example, let's say I have a site-to-site VPN and I am using destination NAT on one side of the tunnel. When traffic comes from one side of the tunnel to the other, destination NAT is performed. One side uses 10.124.4.50/24 as its destination. The firewall on the other side then uses destination NAT to translate this traffic to 10.1.1.50/24. I have seen articles on the Palo website that say you must have a route for this NAT address or have an interface with an IP in that subnet assigned.

I have done destination NAT a number of times to public address spaces to a subnet that did not physically belong to an interface on the Palo. For example, the public address of the Palo is 209.209.209.209 and I am destination NATing a server from 207.207.207.207 to 192.168.50.250. In these cases, I never created a route manually for the before-NAT address/subnet. Is this something that has changed with recent PAN-OS codes?

I ask because I came across a situation similar to what I described above with a VPN tunnel. The other side of the tunnel needed a route for the subnet they were NATing to/from in order for the policy to work. I never had to do this in the cases I have seen, so I am curious why.

Any ideas?

[panos]

Configuring route based IPSec with overlapping networks

I don't think you need a route like that.route for dest. ip is enough.