🔧

Configuring Destination NAT on Palo Alto Firewall

May 14, 2025

Lecture Notes: Configuring and Verifying Destination NAT on Palo Alto Firewall

Introduction

  • Focus on configuring and verifying destination NAT on a Palo Alto firewall.
  • Build upon existing configuration in the 0-60 playlist.

Network Setup

  • New Interface: Ethernet 1/2 connected to Network 10.30.0.0 with a 24-bit mask.
    • Zone: DMZ
    • Server Address: 10.30.0.100 (Windows Server running IIS)

Understanding Destination NAT

  • Definition: Destination NAT swaps the destination IP address of incoming traffic.
  • Initial Flow of Traffic:
    • Client on the internet connects to a global address (e.g., 23.1.2.100).
    • Firewall translates this to the internal server address (10.30.0.100).
  • Reply Traffic: Returned to original global address after translation.

Configuration Steps

  1. Setup the Interface:

    • Go to Network > Interfaces > Ethernet 1/2.
    • Set interface type to Layer 3, associate with the DMZ zone.
    • Configure IPv4 address: 10.30.0.19/24.
    • Associate management profile for connectivity testing.
  2. Configure Destination NAT Rule:

    • Go to Policies > NAT.
    • Add Destination NAT Rule:
      • Name: DNAT for Server
      • Original Packet:
        • Source Zone: Outside
        • Destination Address: 23.1.2.100
        • Destination Zone: Outside
        • Destination Interface: Service Provider A (Ethernet 1/4)
        • Translation: Static IP to 10.30.0.100.
  3. Configure Security Policy Rule:

    • Go to Policies > Security.
    • Add Security Policy:
      • Name: Permit to Server on DMZ
      • Source: Pre-NAT information (Any from Outside)
      • Destination: 23.1.2.100 (Pre-NAT) with Post-NAT Zone as DMZ.
      • Applications Allowed: Ping, SSL, Web Browsing (HTTP).
  4. Commit Configuration:

    • Ensure all configurations are correct and commit changes.
    • Verify that Ethernet 1/2 is connected to VLAN 30.

Testing Configuration

  • Test from Client:
    • Client IP: 23.1.2.61 (Linux Computer).
    • Ping Test: Ping global address 23.1.2.100 (should respond).
    • HTTP Test: Open browser and navigate to 23.1.2.100 (should display IIS default page).

Conclusion

  • Successfully set up DMZ, destination NAT rule, and necessary security policy.
  • All tests confirmed traffic flowing correctly from the client to the DMZ server.
  • Looking forward to future videos on similar topics.