BI-DIRECTIONAL STATIC NAT NOT WORKING

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

BI-DIRECTIONAL STATIC NAT NOT WORKING

L3 Networker

Hi,

 

I have the following situation I want to do a bi-directional NAT for a complete subnet range.

I want to translate 192.168.96.0/24  -->  10.196.96.0/24 :   

   192.196.96.1  --> 10.196.96.1

    192.168.96.2 --> 10.196.96.2

... 

And this in both directions.

When i select bi-directional nat on the NAT policy it is not working for the inbound direction.
screenshot is not corrrect orginal rule has bi-directional set to yes

 

zGomez_0-1698767701056.png

When i create 2 seperate rules it is working:

zGomez_1-1698767778179.png

With the bi-directional it is not doing the nat.  What am I doing wrong on the bi-directional nat?

I actually like it more when i create seperate nat rules because then you have control over the source zone and it is clear from policy.

But i just want to understand why the bi-directional is not working.

 

 

1 REPLY 1

Cyber Elite
Cyber Elite

bi-directional creates 2 nat rules behind the scenes and you can see both of them in cli.

Usually bi-directional messes up zone names so you should never use it and create 2 separate rules instead.

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClWBCA0

 

"Note: The destination NAT rule that is created in a Bi-directional rule, the Source Zone and Source Address in the original packet will be ANY. This can break some traffic if the rule is set up as a Static Source NAT with Bi-Directional. For granular control over the Source and Destination NAT rules, create them separately. This may be necessary if the Bi-Directional NAT is not working in a given configuration."

 

 

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011
  • 1128 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!