NAT Question

[ITSMC24]

I have a question about the PA NATing. I have 8 different internal zones within my test lab. 

Each zone is either assigned to a physical interface or a sub-interface. Would I need a separate NAT rule for each zone to be routed to my egress port (WAN) port? Looking to keep everything neat and simple. Lastly, if that NAT traffic is coming back into the firewall from its (Public facing interface ) my WAN port, do I need to create a NAT for each inbound zone? 

Thanks. 

[JayGolf · Accepted solution]

Hi @ITSMC24 ,

You would need a separate SNAT (Source NAT) policy for each zone to be routed out your egress port. However, if they all share the same translated IP and egress interface then you can create a single SNAT policy where in the policy you can include all internal zones headed out to your untrust/wan zone for internet access. For more granularity, you can create individual SNAT Policies. 

You do not need a separate inbound NAT policy for return traffic. The Palo Alto Firewall is session-based, which means once the outbound session is established, inbound return traffic automatically follows the same session without an additional NAT rule. 

You would need DNAT (Destination NAT) policies if you were hosting public-facing services that need to be redirected to an internal host.