1. Home
    2. PAN-OS
    3. PAN-OS® Networking Administrator’s Guide
    4. NAT
    5. Source NAT and Destination NAT
    6. Source NAT

    Source NAT

    Source NAT is typically used by internal users to access the Internet; the source address is translated and thereby kept private. There are three types of source NAT:
    • Dynamic IP and Port (DIPP)
      —Allows multiple hosts to have their source IP addresses translated to the same public IP address with different port numbers. The dynamic translation is to the next available address in the NAT address pool, which you configure as a
      Translated Address
       pool be to an IP address, range of addresses, a subnet, or a combination of these.
      As an alternative to using the next address in the NAT address pool, DIPP allows you to specify the address of the
      Interface
       itself. The advantage of specifying the interface in the NAT rule is that the NAT rule will be automatically updated to use any address subsequently acquired by the interface. DIPP is sometimes referred to as interface-based NAT or network address port translation (NAPT).
      DIPP has a default NAT oversubscription rate, which is the number of times that the same translated IP address and port pair can be used concurrently. For more information, see Dynamic IP and Port NAT Oversubscription and Modify the Oversubscription Rate for DIPP NAT.
      (
      Affects only PA-7000 Series firewalls that do not use second-generation PA-7050-SMC-B or PA-7080-SMC-B Switch Management Cards
      ) When you use Point-to-Point Tunnel Protocol (PPTP) with DIPP NAT, the firewall is limited to using a translated IP address-and-port pair for only one connection; the firewall does not support DIPP NAT. The workaround is to upgrade the PA-7000 Series firewall to a second-generation SMC-B card.
    • Dynamic IP
      —Allows the one-to-one, dynamic translation of a source IP address only (no port number) to the next available address in the NAT address pool. The size of the NAT pool should be equal to the number of internal hosts that require address translations. By default, if the source address pool is larger than the NAT address pool and eventually all of the NAT addresses are allocated, new connections that need address translation are dropped. To override this default behavior, use
      Advanced (Dynamic IP/Port Fallback)
       to enable use of DIPP addresses when necessary. In either event, as sessions terminate and the addresses in the pool become available, they can be allocated to translate new connections.
      Dynamic IP NAT supports the option for you to Reserve Dynamic IP NAT Addresses.
    • Static IP
      —Allows the 1-to-1, static translation of a source IP address, but leaves the source port unchanged. A common scenario for a static IP translation is an internal server that must be available to the Internet.

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2022 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo