>
    Strata Copilot
    Configure Egress NAT
    Focus
    Download PDF
    Focus
    1. Home
    2. Cloud NGFW for AWS
    3. Cloud NGFW for AWS Administration
    4. Configure
    5. Configure in Cloud NGFW Console
    6. Configure Egress NAT
    Download PDF
    Cloud NGFW for AWS

    Configure Egress NAT

    Table of Contents

    Configure Egress NAT

    Use Egress NAT (network address translation) to perform source address translation on outbound traffic to destinations in the public internet.
    Where Can I Use This?What Do I Need?
    • Cloud NGFW for AWS
    • Cloud NGFW subscription
    • Palo Alto Networks Customer Support Account (CSP)
    • AWS Marketplace account
    • User role (either tenant or administrator)
    Egress NAT performs source address translation on outbound traffic to destinations in the public internet. Cloud NGFW replaces the private source IP addresses of your workloads with public Elastic IP (EIP) addresses before it sends the traffic to the internet, so you control which public addresses your outbound traffic uses.
    Cloud NGFW offers two ways to perform source NAT: AWS NAT Gateway and Cloud NGFW Egress NAT. With Cloud NGFW Egress NAT, you can use EIPs that Palo Alto Networks manages or bring your own IP address space (BYOIP). You can expand a BYOIP pool that is already in use without disrupting active traffic, monitor pool utilization through Amazon CloudWatch metrics, and disable the automatic fallback to the AWS Internet Gateway when the EIP pool is exhausted.
    The number of Cloud NGFW endpoints with Egress NAT customizations that each resource supports depends on your firewall tier. See Cloud NGFW for AWS limits and quotas for the values.
    Egress NAT functionality isn't supported on existing firewalls (those created before this release of Cloud NGFW for AWS). Create a new one to use Egress NAT.
    AWS NAT Gateway
    The Amazon NAT gateway allows your VPC resources in your Private subnets to securely access services outside the subnet, including the public internet, while keeping Private resources inaccessible to unsolicited traffic.
    You can continue to use the AWS NAT gateway in your VPC. In this scenario, the Cloud NGFW acts as a bump-in-the-wire, directing all inspected traffic back to its endpoint.
    You pay AWS for the NAT gateway and for associated Egress data transfer costs.
    The image below illustrates source NAT on Internet-bound traffic using the AWS NAT gateway:
    See Work with NAT gateways for information about using AWS to configure NAT.
    Cloud NGFW Egress NAT
    Alternatively, configure the Egress NAT feature. In this case, Cloud NGFW will perform source NAT on all outbound traffic except for those sessions with destination IP addresses within the Configure Private Traffic Range defined for the endpoint on which the traffic enters the Cloud NGFW resource. In this case, the Cloud NGFW resource does not redirect the inspected traffic back to the endpoint. Alternatively, the inspected egress traffic is sent directly to the internet. You no longer incur AWS NAT gateway costs but would pay Palo Alto Networks for the egress traffic data transfer. However, you will associate public IP addresses to the Cloud NGFW resource in one of two ways:
    1. Configure the Cloud NGFW resource to use Palo Alto Networks managed AWS Elastic IP Address (EIP) addresses to perform source NAT for your VPC. In this case, you’ll incur hourly EIP management costs.
    2. Transfer your BYOIPs to the Cloud NGFW from your AWS account to avoid the hourly EIP management costs. For more information, see BYOIPs with AWS IPAM.
    The image below illustrates how source NAT works on Internet-bound traffic using Cloud NGFW Egress NAT; source NAT on Internet-bound traffic using Cloud NGFW Egress NAT:
    Hybrid NAT Settings
    You can enable Egress NAT for an NGFW resource while customizing it to be disabled on specific endpoints. In this hybrid configuration, the Cloud NGFW operates as follows:
    • Egress NAT Disabled: The Cloud NGFW acts as a bump-in-the-wire, directing all inspected traffic back to the endpoint.
    • Egress NAT Enabled: The Cloud NGFW redirects the inspected traffic directly to the internet rather than back to the endpoint.
    The image below illustrates Egress NAT enabled for endpoint 1 and disabled for endpoint 2:
    Elastic IP Addresses
    In AWS, an elastic IP address (EIP) represents a static IPv4 address, used for dynamic cloud computing. An Elastic IP Address is reachable from the public internet, however, you can associate it with a private instance to enable communication with the internet.
    IPv6 Protocol Compatibility and NAT Limitations
    • Source-Based NAT (SNAT/NAT66): Source-based address translation, also known as NAT66 is not supported for IPv6 traffic. All IPv6-to-IPv6 communication uses native routing without address translation.
    • When EgressNAT is enabled on an IPv6-enabled firewall, source address translation (NAT) is only applied to IPv4 traffic. Outbound IPv6 traffic uses native, legacy IPv6 routing without address translation.
    Egress NAT translates a private IP address to a public routable address by altering the source address of packets passing through the Cloud NGFW, allowing connections to be initiated only for outgoing network connections.
    For Cloud NGFW instances deployed in IPv6 environments, Egress NAT is supported for IPv4 traffic only. IPv6-to-IPv6 communication utilizes native routing without address translation.
    To use your own IP addresses with Cloud NGFW Egress NAT, first create an IPAM pool for BYOIPs in AWS and share it with your Cloud NGFW deployment account.

    Configure Egress NAT with Palo Alto Networks Managed AWS EIPs

    To configure Egress NAT using Palo Alto Networks managed AWS EIPs:
    1. Log in to the Cloud NGFW console.
    2. Click NGFWs.
    3. Create a new NGFW resource.
    4. In the Policy Management section, select your policy management option.
    5. In the Egress NAT section, select Enable Egress NAT.
    6. In the Public IPs section, select AWS Service IPs.
      Select the Public IPs tab in the firewall page to view the list of supported IP addresses for Egress NAT traffic:
      After the firewall is created, verify its status.

    Create a Cloud NGFW Resource, Enable Egress NAT and Specify BYOIPs

    After you complete the steps to create the IPAM pool, you create the Cloud NGFW resource, enable Egress NAT and specify BYOIPs.
    You can add new CIDRs to an existing IP address pool that is already in use by a Cloud NGFW resource without removing the pool from the resource or disrupting active traffic. Removing CIDRs from an in-use pool is not supported while the pool is active; to remove a CIDR, disassociate the pool first.
    To configure Egress NAT using BYOIPs:
    1. Log in to the Cloud NGFW console.
    2. Click NGFWs.
    3. Create a new NGFW resource.
    4. In the Policy Management section, select your policy management option.
    5. In the Egress NAT section, select Enable Egress NAT.
    6. Select Bring Your Public IPs and enter the IPAM pool ID created in step 3 (above).
      The IPAM Pool ID is located in the IPAM Pool Details section.
      Select the Public IPs tab in the firewall page to view the list of supported IP addresses for Egress NAT traffic:
      After the firewall is created, verify its status.
      To release addresses back to your IPAM pool if you choose not to use BYOIPs contact Palo Alto Networks to create a support case.

    © 2026 Palo Alto Networks, Inc. All rights reserved.