NGFW PA820 9.1.4 Strange NAT issue

[MrFritz]

We have a simple basic setup:

WAN1/1 Untrust IP 123.45.67.89/29

LAN1/2 Trust IP 10.9.8.1/16

We NAT our WAN interface out to a different IP in the same network. 123.45.67.90

NAT POL  Trust to Untrust Int1/1 Any Any to 123.45.67.90  

Security Pol is Any Any 

I ping 8.8.8.8 from the LAN1/1 and it NATs out correctly with the .90 address

Devices behind the firewall are not getting NAT'd out, I have pcap that shows this.  The pcap does not show the NAT'd IP just the trust traffic from the device to the LAN1/1 on both outbound and inbound traffic.

 I can also ping the ISP GW from the downstream devices so I can get traffic beyond the FW but nothing beyond that.

[BPry]

@MrFritz 

Take a look at your NAT policy and double check that you actually have it configured correctly. Your traffic logs are also going to be a help here, as you can expose the NAT Source IP field to see what the firewall actually NAT'd traffic to. Weird NAT issues are almost always a result of your NAT rulebase entry not being correctly formatted. 

[MrFritz]

"rule1; index: 1" {
nat-type ipv4;
from Trust;
source 10.0.0.0/8 ;
to Untrust-ISP1;
to-interface ;
destination any;
service 0:any/any/any;
translate-to "src: 170.150.13.150 (dynamic-ip-and-port) (pool idx: 11)";
terminal no;
}

Security Policy

"rule1; index: 1" {
from Trust;
source any;
source-region none;
to Untrust-ISP1;
destination any;
destination-region none;
user any;
category any;
application/service 0:any/any/any/any;
action allow;
icmp-unreachable: no
terminal yes;

[reaper]

Can you check your default route? Since your zone is called untrusted-isp1, is there also an untrust-isp2?

Show routing fib virtual-router default | match 0.0.0.0

[MrFritz]

Untrust-ISP2 is not connected nor is the Zone created:

show routing fib virtual-router VR-1 | match 0.0.0.0
[?1h= 805 0.0.0.0/0 170.150.13.145 ug ethernet1/1 1500