External virtual network pointing to many internal ip

[Bouthaina]

hello,

We are migrating from forcepoint to PA. we face the case below: a virtual network (172.28.66.0/24) is assigned to multiple servers , behind it , there is a group for Such LB in FPT (pointing on 28.66.0 means : one for 172.28.72.2 and 172.28.72.3 for exemple). in PALOALTO, i created DNAT rules for dynamics load balancing between addresses. but , using virtual network that does not exist is posing problem. because all servers are represented as 172.28.66.0 but backend is other networks. how should i declare zones in dnat rules for that virtual network.

thanks

[Raido_Rattameister · Accepted solution]

Do I understand correctly that you want to use "172.28.66.0" as destination IP in NAT rule on "Original Packet" tab but you don't have any interface inside 172.28.66.0/24 zone and no route towards 172.28.66.0/24 in routing table?

In this case you need to use UNTRUST (or whatever represents your Internet zone) in NAT policy as in this case Palo matches destination zone based on 0.0.0.0/0 default route.

In Security policy you still use Post-NAT zone as destination (so wherever your 172.28.72.x servers are).

[Bouthaina]

hello @Raido_Rattameister ,

thank you for response .  i have tested it in lab and even in the costumer infrastructure. that worked ! 

FYI.

😊