PA-850 Static NAT between 2 Switches

[zbSA24]

Hello all.  Looking for help here.  I am trying to create a static NAT between two switches using a vwire, but it doesn't seem to be working.  Can someone please provide steps on how to make this happen?  I do not wish to insert routers between the switches, and wasn't sure if this was possible.  I'm new to networking and firewalls, and have been tasked to try and figure this out.  Any help would be greatly appreciated.

Thanks in advance!

Zach (a struggling SA)

[Claw4609]

Hello,

What does your NAT rule look like? And what exactly is happening, is it not translating? 

Heres an example for the docs: Virtual Wire Static NAT Example (paloaltonetworks.com)

[zbSA24]

So I've been looking at that example myself, and i can't figure out if those routers are physical routers or are they the virtual routers offered in the firewall?

[zbSA24]

When i try to test the NAT, it says no Rule matched. Unfortunately, my equipment is not on an unclass platform that i can take pictures and stuff.

[zbSA24]

here is something i drew up on pp to try and illustrate my problem.  my rules matched what was in the document.

[Claw4609]

I guess Im confused from your picture what you're trying to NAT. In the document those are two routers, not virtual routers on the firewall. Those two routers are not being NAT between each other. One is 198.51.100.1 and the other is 198.51.100.2, with .2 having a route for 198.51.100.100/32 pointing to the other router of .1.

What are you trying to translate to what and what are you trying to solve? If youre trying to have 192.51.100.1/28 route to 192.51.100.2/28 and you have the Palo in-between you wouldn't need to necessarily nat between the two, they would just have to have routes to know where to go.

[zbSA24]

Ok, so my inside switch has a vlan with an ip of 192.51.100.x, and I am trying to translate that to a vlan on my outside switch, to an ip of 22.59.95.x.

[zbSA24]

the PA-850 doesn't like it because it says the translated address isn't in the same subnet (or network for that matter).  But isn't that the purpose of the NAT?