If im not mistaken the NAT rules are session based. Meaning "host2, snat to x.x.x.x" wont collide with "x.x.x.x dnat to host1". The good side (at least IMHO) of doing this manually for each direction is that it will be more visible whats actually going on. If you use bi-directional it will depend on in which order you wrote the nat-rules because: 1) host1, snat to x.x.x.x, bi-directional 2) host2, snat to x.x.x.x, bi-directional wont be the same result as 1) host2, snat to x.x.x.x, bi-directional 2) host1, snat to x.x.x.x, bi-directional because the above case can be extracted into: 1) host2, snat to x.x.x.x 1.5) x.x.x.x dnat to host2 (hidden) 2) host1, snat to x.x.x.x 2.5) x.x.x.x dnat to host1 (hidden) and since PA is top-down first-match any new sessions setup towards x.x.x.x will always be forwarded to host2 (until some admin some day unchecks the bidirectional checkbox and suddently host1 gets all incoming traffic (if there is a security policy that allows that).
... View more
