Tutorial: Understanding the NAT/Security Policy Configuration

[@BobBagheri]

I just spent a week in Texas for the PAN CSL training and had the pleasure of having Mark teach the first two days. Mark was fantastic and I learned a lot. This is a great video. It will really help you understand how NAT works in the Palo world.

[@Kaal_Bhairava1]

Hats off for such a beautiful and simple explanation Mark

[@siddeeq3712]

I'm going to add my two cents and say that this video is very helpful in understanding NAT/Security policy configurations. Searching KZbin for instructional videos on PA can be frustrating due to quality of videos and language/accent. So I enjoyed the clarity of the speaker and his overall knowledge of the subject. Thank you Mark!

[@RahulKumar-hs5os]

was searching for video to understand D-NAT, Finally landed and found this video, Great detailed tutorial.. Thank you so much for such a awesome job. 10/10 ratings.

[@Mistanders0n]

The best explanation of this that I’ve ever seen. Thank you

[@farhanbutt433]

This is by far the best explanation of the most dreaded concept i.e. NAT

[@nikkycooly261]

Super helpful. Prior to watching the video I was seriously confused

[@PaloAltoNetworksLiveCommunity]

We do our best! Please do let us know if there's any other topics that could be helpful in clearing any confusion.

[@Black_Swan68761]

Thank you, Mark. Now I have a clear picture of how the NAT and security policy works.

[@mail2gowthamkumar]

Well Explained Mark Bowling. The checklist way of configuration one step after the other. Perfect one. Thank you.

[@PaloAltoNetworksLiveCommunity]

Thanks for your comment! We're glad you found the video helpful!

[@samual8299]

Great video, cleared up all of my confusion. I only wish the official training was like this, instead of (mostly) a robotic voice sloooowly reading from slides. Thanks!

[@ervinskendaj8087]

really what i was looking for. i was a bit confused on how things works in PA devices. thanks a lot man :)

[@ervinskendaj8087]

hi

[@omarquintanilla696]

Damn!! This video was on point especially the section before describing the lazy function of the bi-directional check box. I loved the explanation of explaining the subtleties of a NAT policy versus a Security Policy. I was actually doing this subliminally with regards to routing internal to the public/global address of my DMZ firewalls, but this video helped a YUGE TONNE, LIKE YOU COULDN'T IMAGINE!!! Thank you Firewall Master Mark!!! #PaloAltoNetworks

[@Grips44]

Perfect u-turn explanation, and more. great video!

[@jamessullo2599]

Very easy to understand the way it's explained here Thanks much

[@junekousa1]

Splendid!!! best ever lecture.

[@Navachakshu]

Awesome video...very very helpful.just to add a point if default intrazone policy has a clean up rule on top of it(few customers do insist for this)then we also have to create a rule for untrust to untrust in order to allow this.

[@miilanshihora4064]

awesome video clear my all doubts.

[@Xevious5]

Mark you're a beast. Thanks for your video!

[@pvcamargoagility]

Uncomplicated with mastery!😎

[@456steel]

Great video... He give a very clear understanding.

[@RickHollmer]

Great video, Mark. Thanks!!

[@gnan86]

Great Explanation !

[@PaloAltoNetworksLiveCommunity]

We're happy this video has helped so many. Thank you for the kudos! Also check out the Live Community at live.paloaltonetworks.com for more info -- feel free to post your questions there, too!

[@kiryukazama_]

in 11:16 result. it should be unchecked bi-dir translation in rule 1 if i put rule 2 bi-dir?

[@winsyrstrife]

Thanks much, Mark, for this simple direct explanation. I understand how the Palo Alto works, but I could never explain it in any way that made sense to someone else. One question: how are you able to get traffic from the internal zone to bypass NAT rule #1, which watches for any destination traffic, and process on NAT rule #3 ("Server 1 from Inside" - Internal > Internet > translated DMZ zone)?

[@nasratshah6191]

thanks dear sir for uploading your training videos

[@9527903681]

Good explanation and thanks.

[@MrSrinupalasa]

Wow really superb

[@cankitchourasia]

Excellent explanation !!

[@salvatorer7758]

At 5:06, why wouldn't the destination zone be DMZ?

[@leetanizer]

Hello, In minute 9:07 ; with this nat policy if a client from 10.1.1.0/24 tries to access the 66.1.1.2 server then the destination NAT in line 2 will not be applied, right ? the access will then fail , am I wrong ?

[@PaloAltoNetworksLiveCommunity]

Hi Karim, thanks for your comment. You are correct, for that scenario, the second NAT rule needs to be above the first one as else the packet will be source translated only (only one NAT policy can be applied at a time)

[@KavanMavati]

Thank you for the video very useful. One question though. Do you need to create NAT rules when you apply the Policy rule between inside subnet (trusted Zones)? Or this not necessary. In my understanding, No NAT need. Since all, I need to allow/Deny traffic from one zone to another just want to double-check.

[@PaloAltoNetworksLiveCommunity]

Hi, if your inside subnets are routable to each other then NAT is likely not needed.

[@KavanMavati]

@@PaloAltoNetworksLiveCommunity Thanks

[@gabrielcruzv5716]

New commer to PA technology and holy, NAT is one of the most mindfuck feature, but this video helps a lot to understand it!

[@PaloAltoNetworksLiveCommunity]

We're happy this video has helped you. Make sure to subscribe to the channel for new and updated videos. Also check out the Live Community at live.paloaltonetworks.com for more info -- feel free to post your questions there, too!

[@franzw70]

Thx Sir, plain as Glass now this topic is :)

[@amarjeetkumar8735]

Awesome...

[@srinivasann2493]

Hi Mark, Thanks for the great stuff. My query is for the Rule-3, when we wanna try to access the server using it's Public IP. This is called as U-turn NAT and we may have to do Source NAT to the interface to the destination to avoid Asymmetric routing. Please assist.

[@PaloAltoNetworksLiveCommunity]

Hi Srinivasan, please check out the U-turn video : kzbin.info/www/bejne/eJXFn2Sml8pqatE

[@anthonyfaucichan3490]

4:30 Nat outside to inside

[@balachandarsivasamy7958]

Great video

[@ViralVideos-vi3tp]

Nice video

[@PaloAltoNetworksLiveCommunity]

Thanks for the positive feedback!

[@gopalsrinivasa6267]

Hi this tutorial is good but at 8:03 you are actually configuring U-TurnNAT Rule in which source should be translated in Rule3 - "Server-1 from Inside". For example in your same channel one video is there with name "How to configure U-TURN NAT". can you explain the same.

[@PANgurus]

True U-turn only applies if the client and server exist in the same subnet/zone For 'soft' U-turn where both client and server are internal but in different zones, a NAT rule only needs to perform destination NAT for the client source to the untrust zone without source NAT

[@gopalsrinivasa6267]

@@PANgurus Thanks for your reply

[@alhaseen1]

Thanks very much

[@marrr7611]

I am running ios 9.1.4 and not able to get the static nat from outside to inside to reach an internal server to work when using the example here. The only way I got it to work was to use on the nat statement ; source zone:outside --- destination zone:inside

[@ashokreddyb7867]

I've a doubt... How is it possible to create "ONE to ONE NAT" twice using the same PUBLIC IP to forward all 0 to 65535 ports??. You have configured two bidirectional NAT using the same public IP. To my mind it's possible only if we use "specific port forwarding". Correct me if I'm wrong.

[@mattcromer511]

What is the benefit to adding the destination address of the public ip on your dmz server for the nat policy vice adding your dmz ip and just going from private to dmz vs private to public to dmz which is what you're doing? Is there any benefit to doing it the way you did verses what I'm saying can be done? Or is what I'm saying not possible on these devices or is one way considered bad practice/best practice; why?

[@PaloAltoNetworksLiveCommunity]

Hi Matt! You may want to review the first few minutes of the video: the destination IP of the server in the DMZ is a public IP, this means the routing table will place it in the 'outside' zone pre-NAT. So your NAT policy will reflect inside to outside for the NAT action, but your final destination is the DMZ so your security policy will reflect inside to DMZ. If you can control the IP the inside client connects to by using two different DNS records for the server's hostname for example, you would not need NAT for connections from inside to DMZ as the inside clients would be able to resolve the private IP

[@mabooali]

good explanation but he is going too fast. best split in two videos in my opinion because even plane NAT is confusing.

[@PaloAltoNetworksLiveCommunity]

Thank you, we appreciate your feedback!

[@prasee5101]

Yes , i watched in .75x speed to understand

[@evanhairston5872]

Amazing explanation!!

[@petroskourris]

Excellent explanation !!

[@PaloAltoNetworksLiveCommunity]

Glad you liked it! Be sure to check out the LIVEcommunity for more great information: live.paloaltonetworks.com