- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
02-01-2024 02:08 AM
hello,
Is it possible to make NAT source by specifying the source port on which I appear for the remote server?
let me explain :
I am located in an inside zone and I would like to go to a specific zone that we will call "partner"
I would like to access a server at this partner by specifying my source port 5060. (not the destination port of the partner server)
The partner server must see me arriving at the source port 5060
02-01-2024 06:02 AM - edited 02-01-2024 06:04 AM
If Source Address Translation is set to "Dynamic IP And Port" then Palo changes source port.
You can try with "Dynamic IP" or "Static IP".
They don't change source port.
With Static IP NAT policy you can map 1 internal IP to 1 wan IP only.
02-01-2024 06:30 AM - edited 02-01-2024 06:35 AM
in fact with "Dynamic IP" or "Static IP" the source port does not change but it is defined randomly by our server
We would like to go out with a source port defined by ourselves ex: 5353, however in Palo Alto when we select dynamic IP or static IP we can only choose the translated address and not the source port
02-01-2024 06:55 AM
You can't specify source port in Palo in NAT policy.
But as Palo is only passing traffic through you need to go to the device that is sending traffic and set the port where traffic should source from.
And if Palo is set to "Dynamic IP" or "Static IP" then this configured source port is not modified.
02-01-2024 07:02 AM
thank you for the answer, unfortunately that's what I thought, modifying the source port from the server is not possible for me so we are blocked.
Don't you think the partner's request to arrive at a specific source port is crazy?
02-01-2024 07:17 AM
In general requesting specific source port is not reasonable unless it is voip.
Port 5060 refers to voip connection.
What voip software are you using on your side that can't send traffic from 5060?
02-01-2024 07:29 AM
We use the Mivoice / Mitel solution
Our VOip solution provider tells us that we cannot configure the source port of the software to communicate
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!