NAT rule being applied wrong

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

NAT rule being applied wrong

L4 Transporter

Hi,

 

we have a static NAT from this ip 192.168.200.8 (zone DMZ)  to 195.57. (zone VPN). But we realised that the NAT rule which is matching is wrong.

Its matching the NAT rule (ftp.arag.es) but this rule has a filter by "Destination zone" Externa. And the real traffic is VPN<->DMZ

 

Why PA is applying this rule if not being include the destiantion zone in the filter??? 

 

 

 

 

 

regards

2 accepted solutions

Accepted Solutions

Cyber Elite
Cyber Elite

Hello,

I'm guessing you need a U-Turn NAT rule so the VPN clients can communicate properly to the external FTP site.

 

https://live.paloaltonetworks.com/t5/Documentation-Articles/Understanding-PAN-OS-NAT/ta-p/60965

 

This is a good article and covers all the NAT types.

 

Hope this helps!

View solution in original post

L4 Transporter

when you create a bidirectional policy, a return policy is created in the background. You can see it just using the CLI 

> show running nat-policy

The return policy changes the destination zone to any and put it as source. so In your case the return policy is going to be

From zone: any

To zone: DMZ

To: 192.57.58.218

Translate to: 192.168.200.8

 

Regards,

Gerardo 

View solution in original post

2 REPLIES 2

Cyber Elite
Cyber Elite

Hello,

I'm guessing you need a U-Turn NAT rule so the VPN clients can communicate properly to the external FTP site.

 

https://live.paloaltonetworks.com/t5/Documentation-Articles/Understanding-PAN-OS-NAT/ta-p/60965

 

This is a good article and covers all the NAT types.

 

Hope this helps!

L4 Transporter

when you create a bidirectional policy, a return policy is created in the background. You can see it just using the CLI 

> show running nat-policy

The return policy changes the destination zone to any and put it as source. so In your case the return policy is going to be

From zone: any

To zone: DMZ

To: 192.57.58.218

Translate to: 192.168.200.8

 

Regards,

Gerardo 

  • 2 accepted solutions
  • 2968 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!