Hit count cannot increase after NAT

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Hit count cannot increase after NAT

L2 Linker

Hi U-turn nat is configured for trust user to ping server located at DMZ. After the user ping the server from trust zone to dmz zone, the security policy count increases, but nat policy count does not increase. Is this normal? if not, why it happen? thank you

 

 

DavidyPalo_0-1640898101134.png

DavidyPalo_1-1640898440563.png

 

 

2 accepted solutions

Accepted Solutions

Cyber Elite
Cyber Elite

Thank you for the post @DavidyPalo and Happy New Year!

 

Based on my experience if NAT U-turn policy is configured correctly and traffic is hitting it, the counter will increase. Could you go to Device > Troubleshooting > The select Test: NAT Policy Match? After you fill all the details, you can click on Execute to see the result of NAT policy match.

 

Typical use case of U-turn NAT is accessing internal resource by using external IP address, however based on NAT policy screen shot you provided, the destination IP address is an internal IP address and destination translated IP address is not visible in screen shot. Would it be possible to provide more details what you want accomplish?

 

Thank you and Regards

Pavel

Help the community: Like helpful comments and mark solutions.

View solution in original post

Cyber Elite
Cyber Elite

Thank you for reply @DavidyPalo

 

This feature has been introduced in PAN-OS 9.0: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/device/device-troubleshooting... If you are running PAN-OS 8.1, you will not see Troubleshoot Tag until you upgrade to 9.0 and higher.

 

Kind Regards

Pavel 

Help the community: Like helpful comments and mark solutions.

View solution in original post

4 REPLIES 4

Cyber Elite
Cyber Elite

Thank you for the post @DavidyPalo and Happy New Year!

 

Based on my experience if NAT U-turn policy is configured correctly and traffic is hitting it, the counter will increase. Could you go to Device > Troubleshooting > The select Test: NAT Policy Match? After you fill all the details, you can click on Execute to see the result of NAT policy match.

 

Typical use case of U-turn NAT is accessing internal resource by using external IP address, however based on NAT policy screen shot you provided, the destination IP address is an internal IP address and destination translated IP address is not visible in screen shot. Would it be possible to provide more details what you want accomplish?

 

Thank you and Regards

Pavel

Help the community: Like helpful comments and mark solutions.

L2 Linker

Thank you PaveIK for your reply. You are correct. Now the issue resolved. 

BTW, when you mentioned "Could you go to Device > Troubleshooting > The select Test: NAT Policy Match? "

Why I cannot see the "Troubleshooting" on my PA? Please see my screenshot below

DavidyPalo_0-1641230423646.png

 

 

 

Cyber Elite
Cyber Elite

Thank you for reply @DavidyPalo

 

This feature has been introduced in PAN-OS 9.0: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/device/device-troubleshooting... If you are running PAN-OS 8.1, you will not see Troubleshoot Tag until you upgrade to 9.0 and higher.

 

Kind Regards

Pavel 

Help the community: Like helpful comments and mark solutions.

L2 Linker

Thank you!

  • 2 accepted solutions
  • 2734 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!