Wire Source NAT Example
Virtual wire deployment of a Palo Alto Networks firewall includes the benefit of providing security transparently to the end devices. It is possible to configure NAT for interfaces configured in a virtual wire. All of the NAT types are allowed: source NAT (Dynamic IP, Dynamic IP and Port, static) and destination NAT.
Because interfaces in a virtual wire do not have an IP address assigned, it is not possible to translate an IP address to an interface IP address. You must configure an IP address pool.
When performing NAT on virtual wire interfaces, it is recommended that you translate the source address to a different subnet than the one on which the neighboring devices are communicating. The firewall will not proxy ARP for NAT addresses. Proper routing must be configured on the upstream and downstream routers in order for the packets to be translated in virtual wire mode. Neighboring devices will only be able to resolve ARP requests for IP addresses that reside on the interface of the device on the other end of the virtual wire. See Proxy ARP for NAT Address Pools for more explanation about proxy ARP.
In the source NAT and static NAT examples below, security policies (not shown) are configured from the virtual wire zone named vw-trust to the zone named vw-untrust.
In the following topology, two routers are configured to provide connectivity between subnets 220.127.116.11/24 and 18.104.22.168/24. The link between the routers is configured in subnet 22.214.171.124/30. Static routing is configured on both routers to establish connectivity between the networks. Before the firewall is deployed in the environment, the topology and the routing table for each router look like this:
Route on R1:
Route on R2:
Now the firewall is deployed in virtual wire mode between the two Layer 3 devices. All communications from clients in network 126.96.36.199/24 accessing servers in network 188.8.131.52/24 are translated to an IP address in the range 184.108.40.206-220.127.116.11. A NAT IP address pool with range 18.104.22.168-22.214.171.124 is configured on the firewall.
All connections from the clients in subnet 126.96.36.199/24 will arrive at router R2 with a translated source address in the range 188.8.131.52-184.108.40.206. The response from servers will be directed to these addresses. In order for source NAT to work, you must configure proper routing on router R2, so that packets destined for other addresses are not dropped. The routing table below shows the modified routing table on router R2. The route ensures the traffic to the destinations 220.127.116.11-18.104.22.168 (that is, hosts on subnet 22.214.171.124/29) will be sent back through the firewall to router R1.
Route on R2:
Recommended For You
Recommended videos not found.