Source Address Translation | Select the Translation Type (dynamic
or static address pool) and enter an IP address or address range
(address1—address2) to which the source address is translated (Translated
Address). The size of the address range is limited by the
type of address pool: Dynamic IP and Port—Address
selection is based on a hash of the source IP address. For a given
source IP address, the firewall uses the same translated source
address for all sessions. Dynamic IP and Port (DIPP) source NAT supports
approximately 64,000 concurrent sessions on each IP address in the NAT
pool. Some models support oversubscription, which allows a single
IP to host more than 64,000 concurrent sessions. Palo Alto
Networks® DIPP NAT supports more NAT sessions than are supported
by the number of available IP addresses and ports. With oversubscription,
the firewall can use IP address and port combinations two times
simultaneously on PA-220, PA-820, PA-850, VM-50, VM-300, and VM-1000-HV
firewalls, four times simultaneously on PA-3200 Series firewalls,
and eight times simultaneously on PA-5220, PA-5250, PA-5260, PA-5280,
PA-7050, PA-7080, VM-500, and VM-700 firewalls when destination
IP addresses are unique.
Dynamic
IP—Translates to the next available address in the specified
range but the port number remains unchanged. Up to 32,000 consecutive
IP addresses are supported. A dynamic IP pool can contain multiple
subnets, so you can translate your internal network addresses to
two or more separate public subnets. Advanced (Dynamic IP/Port Fallback)—Use
this option to create a fallback pool that performs IP and port
translation and is used if the primary pool runs out of addresses.
You can define addresses for the pool by using the Translated
Address option or the Interface Address option;
the latter option is for interfaces that receive an IP address dynamically.
When creating a fallback pool, make sure addresses do not overlap
with addresses in the primary pool.
| 