Static Port Address Translation question

[JohnSturk]

This configuration issue seems like it should be very easy to figure, but I have not performed this in the past and I cannot seem to figure it out.

We will have multiple devices on the trusted network, and I need to NAT them all to a single Public IP address using a different port number for each private device.  All devices will utilize port 443 internally, but I need to do the port translation on the firewall.  The devices are not capable of changing the service port number for HTTPS or HTTP.  I have tried configuration info I have found in the support documents, but everything I see is just changing the port, from say port 443 to 8080 on the firewall and the end device is configured to utilize port 8080 for HTTPS.  The configuration screenshots below are the current NAT and Security Policy and this works as far as just plain NAT is concerned.  I need to be able to translate a port number such as 8080 coming in on the untrusted side to port 443 on the trusted side.  Any help is appreciated.  Thank you

[TomYoung · Accepted solution]

Hi @JohnSturk ,

You have done all the hard work!  You only need the ports now.  Here is a document that is a good start, but missing a couple of items.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/nat-configuration-examples/...

1. The NAT example should have an object tcp-80 (or service-http) for the Original Packet Service.  It is very important when you create service objects for NAT that you specify the destination only, and not the source.  (Unless, of course, you are NATing source ports which is uncommon.)
2. I would not leave the security policy rule service to any.  I would put it tcp-8080 or service-http in that example.  I believe the service in the security policy rule is pre-NAT like the IP.

Thanks,

Tom

[JohnSturk]

Hi Tom,

Thank you so much for your help.  I have the NAT/Port solution functioning properly now.  I overlooked your advice on setting the Destination Port only in the service object.  This was my issue as I had a dumb moment when I set it up.  I fixated on the NAT rule being incorrect that I did not look at the Service Object after I created it.  I have the proper port numbers in the NAT rule, along with the allowed service in the security rule as well as the source IP address of the vendor that will need to access the devices.  Thank you again for your input.

[TomYoung]

You're welcome!

I have seen that many times with customers.