NAT before IPSEC

[Andrew_Bergt]

Hi folks,

We have a vendor requiring a public IP for the encrypted traffic.  Their guidance is based on Cisco configurations using "NAT before IPSEC" configurations.  Can anyone share/link a guide for this configuration on Palo?  Currently on PAN-OS 9.0 should it matter.

Thank you.

[TomYoung]

Hi @Andrew_Bergt ,

NAT before IPsec is configured just like regular NAT except one of your interfaces will be your tunnel.  The tricky part is that you need to add static routes to get NAT to work -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClipCAC.

Thanks,

Tom