Natting issue with new subnet.

[inderjit21]

I am applying destination nat. Natting public ip(untrust zone) to internal ip(trust zone). Public ip subnet is /28.

When access public ip in the monitoring logs it shows me dst zone as Untrust whenit should show dst zone as Trust.

I have policy in place and natting but its not hitting any policy and goes to expicit deny.

[jneo]

Hi there,

Did you apply the appropriate security policies and NAT policies in place for destination NAT?

Generally there are 2 places to check in your configurations:

NAT Policy:

Destination zone : Pre-NAT IP

Destination address : Pre-NAT IP

Destination Translation : Post-NAT IP

Security Policy

Destination zone : Post-NAT

Destination address : Pre-NAT

Source zone : Pre-NAT

I attached an illustration of diagram below for your reference. Hope it clarifies your understanding of destination NAT

[TranceforLife]

@jneo very good explanation. I am also always sharing this video:

https://www.youtube.com/watch?v=aVXzzZEgIA4

[Gertjan-HFG]

I also like @RafisGaripov PAN videos

Here is part 2 of the above nat video 🙂

https://www.youtube.com/watch?v=Qq_T9mcBAYk