DNAT with different external port to different internal port.

[Metgatz]

Hello, how are you all, I hope you are well.

I would like to do the following:

In Fortinet is the following possible, DNAT, with Public IP example:
198.10.100.100:8081 ( alternate port ) ---DNAT-Mapping---Private IP destination 192.168.100.100:80 ( Port 80)

This in PALO ALTO, how is it configured, please your support, thank you very much.

Greetings and I remain attentive

[MP18]

@Metgatz 

Please se below url for Destination NAT with Port  translation

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/networking/nat/nat-configuration-examples/...

Regards

[Metgatz]

Dear, thank you, the example seems more similar to a UTURN-NAT:

In this case, what you are looking for is:
External 198.10.100.100:8081 ( alternate port ) ---DNAT-Mapping---Private IP destination 192.168.100.100:80 ( Port 80).
Externally answer port 8081 and the DNAT in the destination is a port other than the external one, in this case 80.
Another example: 198.10.100.100.100:33899 ( 33899 different port for RDP ), externally answer to 33899 and the DNAT, map it to 192.168.100.100:3389 ( RDP ).

[Metgatz]

@MP18 The procedure / information sent, only allows to do a NAT Portforwarding, to port 8080, since the port is chosen and is mapped to the server that responds on port 8080, but what I am looking for, so the examples, is the following ( This can be done in fortinet )

Is that a user X of internet, for example to place Remote Desktop client on port 190.190.10.10:33899 ( If an alternative one with a 9 of more, 33899 ) The public IP is mapped to a server 192.168.100.100 to the default port 3389.

Public IP: 190.190.10.10:33899 ---DNAT---Mapped 192.168.100.100:3389 ( RDP ).

Please read the previous post as well.

Thank you very much for your assistance
Thank you

[BPry]

@Metgatz,

This is a standard NAT entry. Just create a NAT statement with your source and service object that you want to match and setup the destination translation for the target IP and service you want to utilize. 

[Remo · Accepted solution]

@Metgatz 

Your NAT rule should look something like that:

 

[Metgatz]

@Remo  Thank you, this is what I was looking for, thank