PBF with NAT, how does it works?

[JTR]

Hi Guys

According to document , if there's destination NAT , there'll be second routing lookup to decide outbound zone & interface. But I'm very confused when there's routing and PBF together, In the second routing lookup, how does PBF rule work? Does PBF work based on Pre-NAT destination address or Post-NAT destination address? According to document at the second lookup process works based on POST-NAT destination address, that means if the routing table works fine, it should follow routing table lookup result. But in my customers networks it doesn't look like that.. Using PBF and U-Turn NAT together is really kind of a mess.

Thank you very much.

[mikand]

Would any of these docs be of any help?

Understanding PAN-OS NAT

https://live.paloaltonetworks.com/docs/DOC-1517

Packet Flow in PAN-OS

https://live.paloaltonetworks.com/docs/DOC-1628

[HULK]

Hello,

PBF lookup happens in pre-NAT IP address. Also in PAN firewall NAT evaluate at first with original IP but Apply at the end of flow.

Packet flow on PAN firewall:-

Few more information regarding the same.

Fowarding

Testing Security, NAT and PBF Rules via the CLI

Inbound NAT Policy with Outbound PBF Causing IP-Spoofing Drops

NAT and Security Policies, PBF Failover and Symmetric Return - Dual ISP

Packet Flow in PAN-OS

Hope this helps.

Thanks

[JTR]

Thanks a lot . I'll read these document. Hava a nice day!