Next-Generation Firewall
Virtual Wire Source NAT Example
Table of Contents
Virtual Wire Source NAT Example
See an example topology and the resulting routing table for a virtual wire source NAT
example.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
Virtual wire deployment of a Palo Alto Networks® firewall
includes the benefit of providing security transparently to the
end devices. It is possible to configure NAT for interfaces configured
in a virtual wire. All of the NAT types are allowed: source NAT
(Dynamic IP, Dynamic IP and Port, static) and destination NAT.
Because interfaces in a virtual wire do not have an IP address
assigned, it is not possible to translate an IP address to an interface
IP address. You must configure an IP address pool.
When performing NAT on virtual wire interfaces, it is recommended that you translate the source
address to a different subnet than the one on which the neighboring devices are
communicating. The firewall will not proxy ARP for NAT addresses. Proper routing must be
configured on the upstream and downstream routers in order for the packets to be
translated in virtual wire mode. Neighboring devices will only be able to resolve ARP
requests for IP addresses that reside on the interface of the device on the other end of
the virtual wire. See Proxy ARP for NAT Address Pools for more explanation about
proxy ARP.
In the source NAT example below, security policies (not shown)
are configured from the virtual wire zone named vw-trust to the
zone named vw-untrust.
In the following topology, two routers are configured to provide
connectivity between subnets 192.0.2.0/24 and 172.16.1.0/24. The
link between the routers is configured in subnet 198.51.100.0/30.
Static routing is configured on both routers to establish connectivity
between the networks. Before the firewall is deployed in the environment,
the topology and the routing table for each router look like this:
Route on R1:
Destination | Next Hop |
|---|---|
172.16.1.0/24 | 198.51.100.2 |
Route on R2:
Destination | Next Hop |
|---|---|
192.0.2.0/24 | 198.51.100.1 |
Now the firewall is deployed in virtual wire mode between the
two Layer 3 devices. A NAT IP address pool with range 198.51.100.9
to 198.51.100.14 is configured on the firewall. All communications
from clients in subnet 192.0.2.0/24 accessing servers in network
172.16.1.0/24 will arrive at R2 with a translated source address
in the range 198.51.100.9 to 198.51.100.14. The response from servers
will be directed to these addresses.
In order for source NAT to work, you must configure proper routing
on R2, so that packets destined for other addresses are not dropped.
The routing table below shows the modified routing table on R2;
the route ensures traffic to the destinations 198.51.100.9-198.51.100.14
(that is, hosts on subnet 198.51.100.8/29) will be sent back through
the firewall to R1.
Route on R2:
Destination | Next Hop |
|---|---|
198.51.100.8/29 | 198.51.100.1 |