Configuring Source NAT In Palo Alto Firewall | PART 6

[@WastedMoment]

I've lived in SonicWALLs for years, and these boxes are super easy and straight forward. We just got out first PA-440, and soon converting our whole environment to PA boxes, I have to say a lot of these things make sense, and starts to click when you walk through these parts. Its amazing how much these firewalls have to offer, truly top of the line equipment. I truly appreciate your help with these videos!

[@KeithBarker]

Happy to do it, thanks for the feedback @WastedMoment.

[@owenmorgan857]

Amazing Keith, I truly have learned so much from you over the years. A very big thank you

[@KeithBarker]

Happy to do it, thanks for the feedback Owen Morgan.

[@grahammccann8554]

Thank you, Keith. I always love learning with you. ! ! !😀

[@KeithBarker]

Happy to help! Thank you!

[@01NetworkSolutions]

Keith I can't say enough thank you for all these awesome videos you make!

[@KeithBarker]

Happy to do it, thanks for the feedback @01NetworkSolutions.

[@mohammadalmaazi]

Amazing. Super like. I like Palo Alto test tools

[@edwardguzinski9853]

Hi Keith! Great video! How does the security policy come into play with our source NAT security policy? For example, say I have a server in my DMZ or something that I only want to access certain IP's on the internet. I would imagine I would put these security rules before my more general source NAT security rule. Would that interfere with the NAT policy or would it still hit on that? Thanks!

[@KeithBarker]

Thank you for the question, @edwardguzinski9853. The NAT policy will not allow traffic on its own. The security policy also needs to be implemented to allow for the initial traffic flow.

[@MohitSharma-vs7dz]

Nice Sir, please explain the trouble shooting on CLI mode in future videos

[@KeithBarker]

Thank you for the suggestion Mohit Sharma❗

[@ualeem111]

NAT on virtual wire? Would that be a similar setup?

[@binwang7842]

Hello Keith, is it possible to PAT with both ISP?

[@martyg2333]

Hey Keith is it possible to setup a Palo Alto lab in GNS3 or EVE-NG and replicate what you have done in these lessons? Or do you recommend using the real hardware? I have GNS3 setup but I don't want to waste time if I can't get the full functionality. I guess what I'm getting at is I want to do this myself instead of just watching you do it. What method would you recommend? Thank you in advance you are an amazing teacher.

[@KeithBarker]

Thank you for the question martyg23. Unfortunately, without a license, there isn't access to most of the advanced features. They do sell a lab license for a VM, as well as a lab license hardware bundle. Those options are in the range of $500-$900 US. I bought the hardware bundles from Corporate Armor. Hope that helps, and happy studies.

[@Tyler-k9b3f]

i wonder how NAT works in GP VPN? i have a vpn setup but clients cannot access internal resources. The tunnel interface IP can ping the Domain Controller but clients cannot. The GP VPN gateway and portal use a /32 public IP on the outside interface that is in the same subnet as the /28 public IP that has always been there. Additionally, we do not see anything being blocked and all routes are in place that we see.

[@ErickManuelBarrios]

Great

[@mansbladebarbershop1918]

👌

[@travisloyd9030]

wait wait wait, you specified a destination interface ... if i actually want to have two internet providers, do i need to create two nat policy rules, one for each interface? ... and the palo alto will just magically know which destination interface is being used?

[@KeithBarker]

Thank you for the question @travisloyd9030. The interface used will be based on the L3 routing decision. Then based on the interface used, the NAT policy will be used.

[@amarjeetkumar8735]

How to do nat bypass in pa

[@KeithBarker]

Thank you for the question @amarjeetkumar8735. knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIlCAK

[@majiddehbi9186]

Hi keith Just one question why are u doing so much configurations of Paolo alto

[@KeithBarker]

Thank you for the question majid dehbi. I just finished teaching a course at CBT Nuggets regarding Palo Alto, so I had the hardware ready to go, and thought i would make a few KZbin videos.