Bi-direction Nat logic

[IAmJi1]

hi I have configured a static bidirection NAT which is Trust to Untrust source address 10.149.192.32 destination 10.90.129.51 service any source translation 200.22.1.32 and turned the bi-directional: yes.

I have the security policy any and routing 10.149.0.0/16 and 200.22.0.0/16 is Trust,10.90.129.51 Untrust. I have done troubleshooting from Trust to Untrust source 10.149.192.32 to 10.90.129.51 worked but i have tried the other way which is Untrust to Trust source 10.90.129.51 to destination 200.22.1.32 it did not match the bidirection NAT. When I tried Untrust to Untrust source 10.90.129.51 to destination 200.22.1.32 matched the bidirection NAT policy.

since its bi direction should it match Untrust to trust?

May I know the reason for this please? 

[JayGolf]

Hi @IAmJi1 ,

Quick question, why do you have 200.22.0.0/16 set to inside? How is your VR setup? This could be the reason why your NAT isn't getting hit. Your FW treats 200.22.1.32 as an internal address that lives within the Trust zone. So it seems your FW is routing rather than ever needing to hit that bi-directional DNAT you got there.

 I would also recommend creating a separate DNAT policy. I recommend a separate DNAT policy because "bi-directional" feature creates a second NAT policy that states the Source Zone and Source Address in the original packet will be ANY. 

For example:

Here is a helpful KB on Bi-Directional NAT also check out this Destination NAT Example.

[IAmJi1]

thank you for your reply Jay

we have several ways to get to outside thats why 200.22.0.0/16 is routed Trust

what I don't understand is why does "bi-directional" feature creates second NAT policy Destination Zone as Untrust? why not trust? (there is another router thats in middle of firewall and the devices so the policy works for Trust to Untrust but it did not work for Untrust to Trust)

[Raido_Rattameister · Accepted solution]

"why does "bi-directional" feature creates second NAT policy Destination Zone as Untrust?"

Because if traffic is initiated from Internet side then it is hitting WAN IP of the Palo.

Palo's WAN interface is in Untrust zone and that is why destination zone is Untrust.

I never use bi-directional nat policies as they can cause errors in more complex environments.

It is best always to set up 2 nat policies yourselves. One for SNAT and other for DNAT.

[IAmJi1]

Is there any supporting documents about your answer? Because in the knowledgebase it does not clarify why it makes destination zone untrust.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClWBCA0

it would be great if you could provide some supporting documents 

thank you for your answer

[Raido_Rattameister]

https://live.paloaltonetworks.com/twzvq79624/attachments/twzvq79624/members_discuss/15121/1/TechNote...