Unallowed to apply NAT rule

[Laurent_Dormond]

Hello,

I'm trying to configure double NAT rule (SNAT + DNAT) using Panorama 8.1.4 managing PA 5220 devices running PanOS 8.0.14.

I can valid / commit configuration on Panorama, but when pushing config to devices I get following error message :

• vsys -> vsys4 -> rulebase -> nat -> rules -> Exchange-vers-SMTP -> dynamic-destination-translation unexpected here
• vsys -> vsys4 -> rulebase -> nat -> rules is invalid
• Commit failed

Source Address translation : Dynamic IP -> one unique IP address

I tried to specify Dynamic IP and port instead, same error.

Destination Address translation : Dynamic IP (with session distribution) -> address group (2 IP addresses)

I tried to specify translated ports or leaving blank, same error.

Any idea ?

Regards,

Laurent

[reaper · Accepted solution]

8.0 doesn't support dynamic destination NAT

If you need this functionality you will need to upgrade your firewalls to 8.1

[Laurent_Dormond]

Hi,

indeed, I tried to use static IP instead of Dynamic Ip (with session redistribution) for DNAT and it commits successfully.

Thanks for the info, also we need to upgrade our appliances to PanOS 8.1.

This is a case where managing the applicanes through Panorama in later release could lead to attempt to configure unsupported features...