OS Upgrade from 10.0.10 to 10.1.6 U-Turn NAT Stopped Working

[jprosba]

Hello,

Originally on our PA-3250's we used Source with Bi-Directional NAT and just added in the trusted zone(s) to the security policy for U-Turn NAT to work, and this worked flawlessly. Now we upgraded to 10.1.6 from 10.0.10 and it stopped working. We were able to get some sites working with a new U-Turn NAT statement as mentioned in the article: How to Configure U-Turn NAT - Knowledge Base - Palo Alto Networks and changing the Source with Bi-Directional NAT to a Destination NAT. However, we have servers that need to go to the Internet as a specific IP so Source NAT with dedicated IP will work, but the U-Turn NAT will not work. I have gone through so many configurations for U-Turn, Source and Destination. In fact, using three separate NAT statements: Destination, Source with static source IP and U-Turn completely broke access to the server, even from other trusted zones.

I've been working with Support for a few weeks now, and no answer. Was hoping someone else had the same or similar issue and could point me in the right direction.

Thanks.

[jprosba · Accepted solution]

Resolved it myself. Destination NAT and Source NAT with DIPP and no U-TURN NAT.

[GrandRiver]

Hi, thanks for your updated solution. Does it mean U-turn NAT no longer works and we have to use Destination NAT and Source NAT with DIPP? Can you elaborate a bit more on it?

Thanks.