Destination NAT to address not in same subnet

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Destination NAT to address not in same subnet


I had a quick question about destination NATing to an address not in the same subnet as an interface on the Palo Alto. For example, let's say I have a site-to-site VPN and I am using destination NAT on one side of the tunnel. When traffic comes from one side of the tunnel to the other, destination NAT is performed. One side uses as its destination. The firewall on the other side then uses destination NAT to translate this traffic to I have seen articles on the Palo website that say you must have a route for this NAT address or have an interface with an IP in that subnet assigned.

I have done destination NAT a number of times to public address spaces to a subnet that did not physically belong to an interface on the Palo. For example, the public address of the Palo is and I am destination NATing a server from to In these cases, I never created a route manually for the before-NAT address/subnet. Is this something that has changed with recent PAN-OS codes?

I ask because I came across a situation similar to what I described above with a VPN tunnel. The other side of the tunnel needed a route for the subnet they were NATing to/from in order for the policy to work. I never had to do this in the cases I have seen, so I am curious why.

Any ideas?


L6 Presenter

Configuring route based IPSec with overlapping networks

I don't think you need a route like that.route for dest. ip is enough.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!