NAT Only works part of the time

Showing results for 
Show  only  | Search instead for 
Did you mean: 

NAT Only works part of the time

L2 Linker

Ok, Who knows what's going here...Here is my Scenario..


We're looking at a new Phone Platform and I'm only able to get a NAT to work part of the time.  First, when the IP Phone loads, internal address of, It connects out to the Platform IP of, downloads the config from it's TFTP Service.  Since we don't want our Voice traffic mingled in with our other public traffic, we've NAT'd /16 to a Public IP of, the NAT Works perfectly here.  Next, once the TFTP Load is complete, the Phone tries to register via SIP, same Internal Address to the platform of, however the same NAT Statement is not being used.  I've ran numerous PCAP's, changed NAT several times, moved rules, but everything appears correct.  Furthermore, when I run test nat-policy-match with the proper destination and source on port 5060 and protocol 17, it test out correctly.  


Setup is...


Inside Zone to Destination Zone, source address to destination address, any interface and any service translate type Dynamic IP address of  Anyone have any idea what's going on and why the NAT isn't getting applied 100% of the time?  When I look at the Web GUI of the phone platform, it's showing my phone as being registered with our Public IP of  I am able to place and receive a call, however there is not audio.  Running another PCAP for a call session, all UDP packets from are getting dropped.  


One thing to note, SIP ALG is turned enabled, though I'm not sure if that's the issue.  Do try to get around SIP ALG, I created a custom Application, mirrored from SIP, and setup an Application Override with Inside/Outside, all IP's and UDP 5060, but still having the issue.


I've opened a Support Case, but with it being a low priority, thought I'd reach out to the community to see if anyone has ran into this issue inthe past.


We're running 8.0.8 PAN-OS version.


Also check the logs, they should show what/where its getting blocked and you can adjust you policies accordingly.

Going through the logs, nothing is being blocked by policy to/from by private address/NAT'd Address and the PBX.  Actually, the policy is set to allow any application, Service is Application-Default.  I enabled logging on my Interzone rule, however nothing is being dropped by policy, that I can find.

I hear ya it can be a pain. We use Skype and I can tell you that even having the application set to any and service to application default was not enough. Skype/Lync use like almost every port 50K and up :(. Does your SIP terminate internally or does it flow out over the internet to the provider? I would also say call the provider and see if they can run a trace while your making the test call just to see if they see anything on their end.

Just an FYI, the issue was finally determined to be a bug in Pan-OS 8.0 - 8.1.6.  (PAN-103023).  

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!