LIVEcommunity - Who Me Too'd this solution

Buy or Renew

"why does "bi-directional" feature creates second NAT policy Destination Zone as Untrust?"

Because if traffic is initiated from Internet side then it is hitting WAN IP of the Palo.

Palo's WAN interface is in Untrust zone and that is why destination zone is Untrust.

I never use bi-directional nat policies as they can cause errors in more complex environments.

It is best always to set up 2 nat policies yourselves. One for SNAT and other for DNAT.

Principal Architect @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Who Me Too'd this solution

L0 Member

Me Too date:

Who Me Too'd this solution