Destination NAT vs Source NAT with Bi-directional option

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Destination NAT vs Source NAT with Bi-directional option

L1 Bithead

Hi All,

 

In enterprise network, what are the usage scenarios for Destination NAT and Source NAT with Bi-directional option enable ?

 

Cheers

Harsha

3 REPLIES 3

L6 Presenter

Hi,

 

Very good explanation here:

 

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/networking/nat-configuration-example...

 

https://www.youtube.com/watch?v=aVXzzZEgIA4

 

Doesn't matter enterprise or home network NAT still the same:

 

Source NAT translates your source IP to a different one

Destination NAT translate your destination IP (one use of for enabling access to your internal servers from Internet)

Bi-directional really same as above, means by ticking the box you will create implicit Destination NAT policy. GUI will only show you that it is bidirectional but CLI will display the same rule as two separate (Source and Destination):

 

> show running nat-policy

 

Thx,

Myky 

Cyber Elite
Cyber Elite

Here's a video where I explain several scenarios : Tutorial: Network Address Translation

 

There is only one configuration method allowed where the bi-directional option is supported, and that is for source nat (bi-directional cannot be enabled when destination NAT is configured because the bi-directional option needs to be able to set the destination option in the implied reverse policy

 

if for example the configured rule is like this:

bidirectional nat.png

the bi-directional option will create an implied rule that sets destination translation for IP 2.2.2.2 if the original packet is headed toward 10.0.0.1 coming from the remote zone

 

hope this helps

Tom

 

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Hi All,

 

Thanks a lot for all the explanations.

 

  • 2957 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!