12-30-2023 05:30 PM
It is easier to understand the reason where pre-nat IP and post-nat zone comes from if you look how packet flows through Palo.
When packet comes in then forward lookup is performed (pbf, routing table) and it is easy to change destination zone in packet metadata (#1).
All security checks are performed after destination zone is updated but destination IP is still original (#2).
When all security checks (service, appid, decryption policy, security profile etc) allow traffic through then destination IP is changed in the packet right before packet is sent to the wire (#3).
It makes no sense to change destination IP in the packet during "NAT Policy Evaluation" step and waste cpu cycles calculating packet checksums etc if packet might be dropped by so many steps in between being sent out.
