NAT - with URL for NAT policy

[Jedi_D]

Hello Folks, 

I need some advice ....

I want to create a NAT rule to allow traffic to NOT be NATTED if it is going to a particular website. 

e.g. if going to www.paloaltonetworks.com then dont NAT.

Is it possible to use URL objects for in a NAT policy??

Please could someone suggest how this can be done, or send me some useful links for doing this?

Thanks

[michaelbell]

You can use fully qualified domain names as targets/source for your NAT rules e.g. google.com

You can't use HTTP urls e.g. www.google.com/examplepage as URL processing happens after NAT is completed.

Is that what you were after?

[jeremy.larsen]

That is a particularly odd request.  Do you mind me asking the what the use case is?

[Jedi_D]

It's for a service that is available over leased line well as the internet. I want to use the leased line for these services instead of using the default NAT statement for the internet.

[jeremy.larsen · Accepted solution]

You could put the leased line in it's own zone and just exclude it from your NAT statements.

Example - (zones USERS, LEASED, INTERNET)

src USERS -> dst LEASED = NO NAT  (this statement probably not necessary since it's already routed?)

src USERS -> dst INTERNET = NAT

[hshawn]

If I understand what you are going for you may be able to use policy based forwarding to direct the traffic to the zone/interface of your choosing instead of out to the internet

[Jedi_D]

Thanks, I simply created a new DMZ for the leased line