- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
07-16-2012 06:20 AM
I'm trying to set up a fairly simple configuration where we have our separate wired and wireless networks connecting to the internet via one shared interface eth1/1
Basically, I am attempting to replicate the configuration here https://live.paloaltonetworks.com/docs/DOC-1884 (but with only 2 local networks, not 3). This document stresses that explicit NAT rules must be set up, but does not give an example on how to do this.
I have set up untagged sub interfaces, the virtual routers, policies and what I believe to be the correct NAT policies. I know these are correct because if I only set up one sub interface everything is OK.
As soon as I set up a second subinterface and hook it up to the virtual router, traffic stops flowing. I am assuming that is because I have not created the NAT policy correctly.
Please can somebody provide an example NAT policy for an untagged subinterface.
Thanks.
09-12-2012 05:38 PM
Without source NAT, untagged subinterfaces will not work. We have to map traffic to a particular zone/vsys based on the destination of that packet (it must match a subinterface IP address). Please refer to following doc in order to configure right NAT rules for untagged subinterfaces. Please let us know if that helps.
09-12-2012 05:38 PM
Without source NAT, untagged subinterfaces will not work. We have to map traffic to a particular zone/vsys based on the destination of that packet (it must match a subinterface IP address). Please refer to following doc in order to configure right NAT rules for untagged subinterfaces. Please let us know if that helps.
05-10-2016 02:42 PM - edited 05-10-2016 02:48 PM
HI
We have exact same scenario, but rather than doing the NAT with the ip address of the interface, we need to nat with 1 of the ip address which is the same range with FW sub interface (untagg).
What we are trying to do is PA firewall running multiple VSYS, each VSYS will share one physical interface with multiple untagg subinterfaces, and each VSYS to get 1 public ip each from the same range. Also some of the extra remaining public IP address we need to perform 1 to 1 NAT.
1 to 1 NAT works fine when public ip address is configured on main interface of fw with untag, NAT doesn't work anymore when we move public ip to sub interface(untagg). However, communication from multiple VSYS with untag sub interface still can communicate with outside world via ip address assigned on untag sub interfaces.
Please could you help ? Thanks
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!