How to set up Excempt NAT in Palo Alto Networks

[ra7oub4]

Hello,

I have a VOIP server in the enternal LAN  related to other site . I need to do a NAT to the traffic in the LAN and not this server .

How can I set up the exempt NAT in Palo Alto Networks?

I add two rules in PAN:

First rule : No NAT for the source ( address IP of this server ) destination (WAN)

Second rule :: PAT NAT : source (any ) destination (WAN) translated to untrust interface.

But always we are blocked to communicate with other servers with those rules.

Please i need your help to solve this problem.

Thank you very much.

[kiwi]

Hi @ra7oub4,

Exempt NAT is done as explained here :

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-To-Create-a-quot-No-NAT-quot-Policy/...

Have you verified your NAT is working correctly ? (in the CLI use 'show session ....' to verify the translation)

Do you have the correct allow policies in place ?

You may also find this main documentation on nat operations helpful.

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/networking/nat.html

Hope it helps,

-Kiwi.

[ra7oub4]

@kiwiThank you very much for your response .

The issue is solved by add another rule of NAT in the inverse (from wan to lan ) with "None" action in the translation .

Thanks .

Have a nice day