Prefix to Prefix NAT on Palo Alto Firewalls

[HKoppuravori]

Hello,

Can we configure prefix-to-prefix NAT translations on Palo Alto firewalls? Is there any easy way to do this?

For Example -

SRC - 10.1.1.0/24

DST - 1.1.1.1

SRC Translation to 10.1.2.0/24

SRC - 1.1.1.1

DST - 10.1.1.0/24

DST Translation to 10.1.2.0/24

[TomYoung]

Hi @HKoppuravori ,

That should work as you configured, and it should keep the 4th octet the same.  It's strange that I can only find examples in old documentation ->

https://live.paloaltonetworks.com/twzvq79624/attachments/twzvq79624/members_discuss/15121/1/TechNote....  See Example #5 on page 18.

Thanks,

Tom

[aleksandar.astardzhiev]

Hey @HKoppuravori ,

I can confirm what @TomYoung explained, just to highlight that this is possible as long as the original and translated networks are exactly the same lenght - /24 natted to /24, or /28 natted to /28. Commit will fail if you try to nat different prefixes.