Prisma Access - Global Protect: No Source NAT

[MichealSwart]

Hi All,

I am new to Prisma Access.

We have done the setup as per PAN.

My question is as follow:

How do you disable source NAT for traffic in Prisma Access for Global Protect, that is going to your internal DC`s?

Kind Regards,

Micheal Swart

[nikoolayy1 · Accepted solution]

Are you talking abound Inbound Access that allows access over the Internet to internal applications where you access the internal DC application using a Prisma Access Public IP address? If so then see:

-----------

You must

Enable source NAT

in the

Inbound Access

tab if you select this check box. Source NAT is a requirement to allow inbound flows to other remote networks.

--------

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-ad...

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-cloud-managed-admin/secure-remo...

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-ad...

Edit:

Also in many cases X-Forwarded-For (XFF) HTTP header insertion will help as the servers will be able to see the real client ip or for cloud applications that may use this when going to the Internet but for some reason when I talked with Palo Alto they don't think this feature is needed at all but I think it is as when going to a web site in Internet not in a Remote Network or Service location many proxy have this option as then the client ip address is always changed to the one the on-prem or cloud proxy has 🙂

[nikoolayy1]

If you managed to get the needed answers, please flag the question as answered.