NAT Performance Issue

[CafNetMatt]

Hi All,

I recently migrated a client from a Fortinet firewall to a PANW.  Most of the Virtual IPs from the Fortinet were migrated as bidirectional Source NATs.

One specific server had issues where outside traffic would intermittently not be able to connect with the server.  I troubleshot the issue and couldn't find anything wrong with the NAT or anything else.

The client opened a ticket with PANW support.  The support tech broke the bidirectional NAT into separate a SNAT and DNAT.

The DNAT is interesting in that the traffic from the outside is being SNAT'ed to the LAN interface on the firewall using dynamic-ip-and-port and then a destination translation to the inside server address with a port translation back to 443.

The SNAT is normal except is was also created using dynamic-ip-and-port to the server's public address.

here's the XML config for the DNAT:

<entry name="Server">

                  <to>

                    <member>Outside</member>

                  </to>

                  <from>

                    <member>Outside</member>

                  </from>

                  <source>

                    <member>any</member>

                  </source>

                  <destination>

                    <member>server-NAT</member>

                  </destination>

                  <service>any</service>

                  <nat-type>ipv4</nat-type>

                  <to-interface>any</to-interface>

                  <destination-translation>

                    <translated-address>server-inside</translated-address>

                    <translated-port>443</translated-port>

                  </destination-translation>

                  <source-translation>

                    <dynamic-ip-and-port>

                      <interface-address>

                        <ip>10.1.1.250/24</ip>

                        <interface>ethernet1/4</interface>

                      </interface-address>

                    </dynamic-ip-and-port>

                  </source-translation>

                </entry>

This fixed the issue.

Can someone provide some insight as to why and what the issue actually was?  I'd just like to know for the future.  The support tech didn't provide the "why" to the client.

Gracias!

[SDorsey]

I do not know the answer but can confirm I have seen this same behavior.

[CafNetMatt]

At least I know I'm not going nuts or completely incompetent.  :smileysilly: