Who rated this post

Hi @DongQu ,

This is a bit tricky. You see PAN first determine the destination zone and then evaluates NAT. For this reason for the NAT rule you need to use pre-NAT zones. Which means that for the destination zone you need to use the zone, which correspond with the network before the nat...I know it may sound confusing (even worst with my bad english) but take simpler example:

Imagine you want to do destination NAT so Internet users to reach your internal server. In this case you will create NAT rule like:

- source zone: unstrust/public

- source IP: any

- destination ip :50.50.50.50 (your public server ip)

- destination zone: untrust/public

- translated destination 10.10.10.10 (your private server ip)

You may notice that destination zone is not your internal (as you expect, because the server is in the internal zone), but it is again untrust. That is bacause 50.50.50.50 is not in your routing table and the FW is following the default route, deciding that 50.50.50.50 is related to untrust zone.

In your case you need to configure destination NAT, but not from public, but from the vpn tunnel. Which means your NAT will look like this:

- source zone: vpn-tunnel

- source ip: remote networks

- destination zone: this is the trickypart

- destination ip: local NAT network

- translated destination: local original network

And here come the tricky part: Your firewall will perform route lookup for the "local NAT network" to see which zone it is related. If it doesn't match any specific route it will match your default, therefor fw will think the destination zone is your untrust. So at the end your nat should use destination zone untrust (or what ever zone match the route for nat network)

This could be a bit misleading for someone else that is looking at the config after some time. For that reason in  @harishsidhartha example configuration you will see static route for the local NAT network pointing to the tunnel. The only purpose of this route is to tell the FW to associate this NAT network with vpn-tunnel zone. That way when you configure your NAT rule you need to use source and destination zone = vpn-tunnel

Another approach would be to leave the destination zone to any. Select souce zone and ip, and destination ip, but this will be equivelent to just enabling bi-directional option in the source nat rule (from local to remote). Even that you use destination zone any you don't have to worrie if different traffic match this rule, because you have still specified source zone and destination ip. And because there is no way similar traffic to be received from any other interface or tunnel, you can be sure that only traffic from that tunnel will be nat-ed