NAT Translated Packet Tab
Table of Contents
Expand all | Collapse all
-
- Firewall Overview
- Features and Benefits
- Last Login Time and Failed Login Attempts
- Message of the Day
- Task Manager
- Language
- Alarms
- Commit Changes
- Save Candidate Configurations
- Revert Changes
- Lock Configurations
- Global Find
- Threat Details
- AutoFocus Intelligence Summary
- Configuration Table Export
- Change Boot Mode
-
- Objects > Addresses
- Objects > Address Groups
- Objects > Regions
- Objects > Dynamic User Groups
- Objects > Application Groups
- Objects > Application Filters
- Objects > Services
- Objects > Service Groups
- Objects > Devices
- Objects > External Dynamic Lists
- Objects > Custom Objects > Spyware/Vulnerability
- Objects > Custom Objects > URL Category
- Objects > Security Profiles > Antivirus
- Objects > Security Profiles > Anti-Spyware Profile
- Objects > Security Profiles > Vulnerability Protection
- Objects > Security Profiles > File Blocking
- Objects > Security Profiles > WildFire Analysis
- Objects > Security Profiles > Data Filtering
- Objects > Security Profiles > DoS Protection
- Objects > Security Profiles > Mobile Network Protection
- Objects > Security Profiles > SCTP Protection
- Objects > Security Profile Groups
- Objects > Log Forwarding
- Objects > Authentication
- Objects > Packet Broker Profile
- Objects > Schedules
-
-
- Firewall Interfaces Overview
- Common Building Blocks for Firewall Interfaces
- Common Building Blocks for PA-7000 Series Firewall Interfaces
- Tap Interface
- HA Interface
- Virtual Wire Interface
- Virtual Wire Subinterface
- PA-7000 Series Layer 2 Interface
- PA-7000 Series Layer 2 Subinterface
- PA-7000 Series Layer 3 Interface
- Layer 3 Interface
- Layer 3 Subinterface
- Log Card Interface
- Log Card Subinterface
- Decrypt Mirror Interface
- Aggregate Ethernet (AE) Interface Group
- Aggregate Ethernet (AE) Interface
- Network > Interfaces > VLAN
- Network > Interfaces > Loopback
- Network > Interfaces > Tunnel
- Network > Interfaces > SD-WAN
- Network > VLANs
- Network > Virtual Wires
-
- Network > Network Profiles > GlobalProtect IPSec Crypto
- Network > Network Profiles > IPSec Crypto
- Network > Network Profiles > IKE Crypto
- Network > Network Profiles > Monitor
- Network > Network Profiles > Interface Mgmt
- Network > Network Profiles > QoS
- Network > Network Profiles > LLDP Profile
- Network > Network Profiles > SD-WAN Interface Profile
-
-
- Device > Setup
- Device > Setup > Management
- Device > Setup > Interfaces
- Device > Setup > Telemetry
- Device > Setup > Content-ID
- Device > Setup > WildFire
- Device Setup Ace
- Device > Setup > DLP
- Device > Log Forwarding Card
- Device > Config Audit
- Device > Administrators
- Device > Admin Roles
- Device > Access Domain
- Device > Authentication Sequence
- Device > Device Quarantine
-
- Security Policy Match
- QoS Policy Match
- Authentication Policy Match
- Decryption/SSL Policy Match
- NAT Policy Match
- Policy Based Forwarding Policy Match
- DoS Policy Match
- Routing
- Test Wildfire
- Threat Vault
- Ping
- Trace Route
- Log Collector Connectivity
- External Dynamic List
- Update Server
- Test Cloud Logging Service Status
- Test Cloud GP Service Status
- Device > Virtual Systems
- Device > Shared Gateways
- Device > Certificate Management
- Device > Certificate Management > Certificate Profile
- Device > Certificate Management > OCSP Responder
- Device > Certificate Management > SSL/TLS Service Profile
- Device > Certificate Management > SCEP
- Device > Certificate Management > SSL Decryption Exclusion
- Device > Certificate Management > SSH Service Profile
- Device > Response Pages
- Device > Server Profiles
- Device > Server Profiles > SNMP Trap
- Device > Server Profiles > Syslog
- Device > Server Profiles > Email
- Device > Server Profiles > HTTP
- Device > Server Profiles > NetFlow
- Device > Server Profiles > RADIUS
- Device > Server Profiles > TACACS+
- Device > Server Profiles > LDAP
- Device > Server Profiles > Kerberos
- Device > Server Profiles > SAML Identity Provider
- Device > Server Profiles > DNS
- Device > Server Profiles > Multi Factor Authentication
- Device > Local User Database > Users
- Device > Local User Database > User Groups
- Device > Scheduled Log Export
- Device > Software
- Device > Dynamic Updates
- Device > Licenses
- Device > Support
- Device > Policy Recommendation > IoT
- Device > Policy > Recommendation SaaS
-
- Network > GlobalProtect > MDM
- Network > GlobalProtect > Clientless Apps
- Network > GlobalProtect > Clientless App Groups
- Objects > GlobalProtect > HIP Profiles
-
- Use the Panorama Web Interface
- Context Switch
- Panorama Commit Operations
- Defining Policies on Panorama
- Log Storage Partitions for a Panorama Virtual Appliance in Legacy Mode
- Panorama > Setup > Interfaces
- Panorama > High Availability
- Panorama > Administrators
- Panorama > Admin Roles
- Panorama > Access Domains
- Panorama > Device Groups
- Panorama > Plugins
- Panorama > Log Ingestion Profile
- Panorama > Log Settings
- Panorama > Server Profiles > SCP
- Panorama > Scheduled Config Export
- Panorama > Device Registration Auth Key
NAT Translated Packet Tab
- Policy > NAT > Translated Packet
For Source Address Translation, select the Translated
Packet tab to determine the type of translation
to perform on the source, the
address, and possibly the port to which the source is translated.
You can also enable Destination Address Translation for an internal
host to make it accessible by a public IP address. In this case,
you define a public source address and destination address in the Original
Packet tab for an internal host and, on the Translated
Packet tab, you configure Static IP or Dynamic
IP (with session distribution) and enter the Translated
Address. Then, when the public address is accessed,
it is translated to the internal (destination) address of the internal
host.
NAT Rule - Translated Packet Settings | Description |
---|---|
Source Address Translation | Select the Translation Type (dynamic
or static address pool) and enter an IP address or address range
(address1—address2) to which the source address is translated (Translated
Address). The size of the address range is limited by the
type of address pool:
|
Source Address Translation (cont) |
|
Bi-directional | (Optional) Enable bidirectional
translation for a Static IP source address translation
if you want the firewall to create a corresponding translation (NAT or
NPTv6) in the opposite direction of the translation you configure. If
you enable bidirectional translation, you must ensure that you have security
policies in place to control the traffic in both directions. Without
such policies, the bidirectional feature allows packets to be translated
automatically in both directions. |
Destination Address Translation | Configure the following options
to have the firewall perform destination NAT. You typically use
Destination NAT to allow an internal server, such as an email server,
to be accessible from the public network. |
Translation Type and Translated Address | Select the type of translation
the firewall performs on the destination address:
|
Session Distribution Method | If you select the destination NAT translation
to be to Dynamic IP (with session distribution),
it’s possible that the destination translated address (to an FQDN,
address object, or address group) can resolve to more than one address.
You can choose how the firewall distributes (assigns) sessions among those
addresses to provide more balanced session distribution:
|
Enable DNS Rewrite | In PAN-OS 9.0.2 and later 9.0 releases,
if the destination NAT policy rule type is ipv4 and
the destination address translation type is Static IP,
the Enable DNS Rewrite option is available.
You can enable DNS rewrite if you use destination NAT and also use
DNS services on one side of the firewall to resolve FQDNs for a
client on the other side of the firewall. When the DNS response
traverses the firewall, the firewall rewrites the IP address in
the DNS response, relative to the original destination address or
translated destination address that the DNS response matches in
the NAT policy rule. A single NAT policy rule has the firewall perform
NAT on packets that match the rule and perform NAT on IP addresses in DNS responses
that match the rule. You must specify how the firewall performs
NAT on an IP address in a DNS response relative to the NAT rule—reverse
or forward:
|