Hit count cannot increase after NAT

[DavidyPalo]

Hi U-turn nat is configured for trust user to ping server located at DMZ. After the user ping the server from trust zone to dmz zone, the security policy count increases, but nat policy count does not increase. Is this normal? if not, why it happen? thank you

[PavelK · Accepted solution]

Thank you for the post @DavidyPalo and Happy New Year!

Based on my experience if NAT U-turn policy is configured correctly and traffic is hitting it, the counter will increase. Could you go to Device > Troubleshooting > The select Test: NAT Policy Match? After you fill all the details, you can click on Execute to see the result of NAT policy match.

Typical use case of U-turn NAT is accessing internal resource by using external IP address, however based on NAT policy screen shot you provided, the destination IP address is an internal IP address and destination translated IP address is not visible in screen shot. Would it be possible to provide more details what you want accomplish?

Thank you and Regards

Pavel

[DavidyPalo]

Thank you PaveIK for your reply. You are correct. Now the issue resolved. 

BTW, when you mentioned "Could you go to Device > Troubleshooting > The select Test: NAT Policy Match? "

Why I cannot see the "Troubleshooting" on my PA? Please see my screenshot below

[PavelK · Accepted solution]

Thank you for reply @DavidyPalo

This feature has been introduced in PAN-OS 9.0: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/device/device-troubleshooting... If you are running PAN-OS 8.1, you will not see Troubleshoot Tag until you upgrade to 9.0 and higher.

Kind Regards

Pavel 

[DavidyPalo]

Thank you!