Source NAT question

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Source NAT question

L1 Bithead


Is it possible to make NAT source by specifying the source port on which I appear for the remote server?

let me explain :


I am located in an inside zone and I would like to go to a specific zone that we will call "partner"
I would like to access a server at this partner by specifying my source port 5060. (not the destination port of the partner server)
The partner server must see me arriving at the source port 5060


Cyber Elite
Cyber Elite

If Source Address Translation is set to "Dynamic IP And Port" then Palo changes source port.

You can try with "Dynamic IP" or "Static IP".

They don't change source port.


With Static IP NAT policy you can map 1 internal IP to 1 wan IP only.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

in fact with "Dynamic IP" or "Static IP" the source port does not change but it is defined randomly by our server
We would like to go out with a source port defined by ourselves ex: 5353, however in Palo Alto when we select dynamic IP or static IP we can only choose the translated address and not the source port

Cyber Elite
Cyber Elite

You can't specify source port in Palo in NAT policy.

But as Palo is only passing traffic through you need to go to the device that is sending traffic and set the port where traffic should source from.

And if Palo is set to "Dynamic IP" or "Static IP" then this configured source port is not modified.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

thank you for the answer, unfortunately that's what I thought, modifying the source port from the server is not possible for me so we are blocked.
Don't you think the partner's request to arrive at a specific source port is crazy?

Cyber Elite
Cyber Elite

In general requesting specific source port is not reasonable unless it is voip.

Port 5060 refers to voip connection.

What voip software are you using on your side that can't send traffic from 5060?

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

We use the Mivoice / Mitel solution
Our VOip solution provider tells us that we cannot configure the source port of the software to communicate

  • 6 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!