WAN Failover NAT issue

[ClintL]

Hello all,

I am trying to set up WAN failover on a Palo Alto PA-3020.  I used the document at the bottom of this post.  When I unplug the interface that is set up in the PBR, it switches over to the secondary ISP like it is supposed to.  The problem is the Primary-NAT policy is still active so traffic doesn't pass because the Backup-NAT never takes effect.  If I manually disable the Primary-NAT rule then I see traffic able to leave the Palo Alto.  I noticed the document is for PANOS 3.1 but it doesn't look like much has changed as far as settings go.  Does this setup still work for 6.0+?  If so is there something I am missing so the Backup-NAT rule takes over?  I didn't see anywhere that tells the NAT policies themselves to failover.

Dual ISP Branch Office Configuration

[panos]

could you please share your nat rules here

[ClintL]

Sure.  I basically set it up just like the document stated unless I missed something.

[panos · Accepted solution]

you have to choose destination interface on Nat rules

This is because you hit always first rule.

[ClintL]

That was it.  Yeah I just missed that part in the document.  Works like a charm now.  Thanks panos!