3.1 Source, Destination, and Twice-NAT Policy Configurations

3.1 Source, Destination, and Twice-NAT Policy Configurations

Network Address Translation (NAT) in Palo Alto Networks PAN-OS is fundamentally decoupled from Security Policy enforcement. While security policies dictate whether traffic is allowed or denied, NAT policies determine if and how packet IP addresses and transport-layer port numbers are translated as packets traverse the firewall. PAN-OS operates a stateful NAT engine that automatically creates matching translation entries for return flow traffic, ensuring bidirectional communication without requiring explicit return NAT rules.

Understanding the precise mechanics of Source NAT, Destination NAT, Twice-NAT, and the underlying lookup architecture is vital for network security engineers configuring Next-Generation Firewalls (NGFWs) in complex enterprise environments.

---

Source Network Address Translation (Source NAT)

Source NAT (SNAT) modifies the source IP address and/or source port of outbound packets. It is primarily deployed when internal hosts with private RFC 1918 addresses require access to external networks such as the Internet or public clouds.

PAN-OS supports three distinct Source NAT translation types:

1. Dynamic IP and Port (DIPP)

Dynamic IP and Port (DIPP), commonly referred to as Port Address Translation (PAT) or port overload, allows multiple internal private IP addresses to share one or more public IP addresses by translating both source IP addresses and source port numbers.

• Port Oversubscription: PAN-OS assigns a unique source port for each concurrent outbound session. A single public IP address can theoretically support up to 64,000 concurrent sessions per protocol (TCP, UDP).
• Interface Fallback: DIPP rules can be bound directly to an egress interface IP address, ensuring automatic translation even when dynamic public WAN IPs change via DHCP.
• DIPP Pool Oversubscription & Allocation: If the primary DIPP pool reaches port capacity, PAN-OS can allocate secondary IP addresses from a configured pool. If port exhaustion occurs, new outbound sessions are dropped.
• Use Case: General user outbound Internet access.

2. Dynamic IP (DIP)

Dynamic IP (DIP) translates an internal source IP address to a public source IP address selected from a pool of addresses without translating transport layer ports (1-to-1 dynamic binding).

• Address Pool Allocation: When an internal host initiates a session, PAN-OS assigns an unused IP address from the designated translation pool to that internal host for the duration of its sessions.
• Session Limit & Reserve IP: If all public IPs in the DIP pool are actively assigned, subsequent new internal hosts attempting to initiate traffic will be blocked unless a fallback DIPP pool is configured.
• Use Case: Legacy applications or strict security protocols (such as certain VoIP or database connections) that reject transport port translation.

3. Static IP NAT

Static IP NAT establishes a permanent, fixed 1-to-1 mapping between a single private internal IP address and a single public external IP address.

• Bidirectional NAT: When configured with the Bi-directional checkbox enabled, PAN-OS automatically creates a implicit Destination NAT rule for inbound traffic originating from external networks targeted at the public IP address, routing it to the private IP address.
• Use Case: Publicly accessible servers (e.g., mail servers, web servers) requiring predictable outbound IP identity.

---

Destination Network Address Translation (Destination NAT)

Destination NAT (DNAT) modifies the destination IP address and optionally the destination port of inbound packets. DNAT allows external clients on public networks to reach internal servers hosted behind private IP subnets.

Virtual IP (VIP) and Port Forwarding

• Static Destination NAT: Maps a public destination IP to a private internal server IP address without changing the port.
• Port Forwarding (Service Translation): Translates both the public destination IP address and the destination port number (e.g., translating public IP 203.0.113.50:8443 to internal server 10.0.1.50:443). This permits hosting multiple distinct internal services behind a single public IP address.
• Dynamic Destination NAT: Translates a single public IP or range to a pool of internal destination IP addresses, often used for basic destination load balancing across internal application targets.

---

Twice-NAT (Bi-Directional Dual Translation)

Twice-NAT occurs when a single NAT policy rule translates both the Source IP/Port AND the Destination IP/Port of a packet simultaneously.

[Client: 192.168.10.50] ----> (Firewall Twice-NAT) ----> [Server: 10.200.1.100]
  Src: 192.168.10.50             Src NAT: 172.16.1.50      (Translates Client IP)
  Dst: 192.168.10.100            Dst NAT: 10.200.1.100     (Translates Virtual Dst IP)

Primary Use Cases for Twice-NAT:

1. Overlapping IP Subnets: When two merging enterprise networks or B2B IPsec VPN partners share identical RFC 1918 address spaces (e.g., both sides use 192.168.1.0/24), Twice-NAT translates the local source IP to a virtual pool AND translates the destination IP to a target virtual pool, resolving routing ambiguity.
2. Enforcing Symmetric Return Paths: In environments where an internal server does not use the Palo Alto firewall as its default gateway, translating the incoming external client source IP to an internal firewall-facing IP address forces the server to send return packets back to the firewall, preventing asymmetric routing.

---

NAT Rule Matching Order

PAN-OS evaluates NAT policy rules using a strict top-to-bottom, first-match algorithm:

• The firewall compares incoming packet headers against NAT rules in sequential order.
• As soon as a packet matches all criteria of a NAT rule, PAN-OS applies that rule and stops evaluating further NAT rules.
• If no NAT rule matches, the packet passes through untranslated.

---

Translation vs. Security Policy Zone and IP Evaluation

A critical area of confusion on the PAN-NGFW Engineer exam is how Security Policies interact with NAT rules. PAN-OS enforces a strict separation between NAT lookup and Security Policy lookup.

When a packet arrives at the firewall, PAN-OS performs NAT and Security policy evaluations using specific combinations of original (pre-NAT) and translated (post-NAT) attributes:

1. NAT Policy Match Criteria:

   • Original Source Zone
   • Original Destination Zone (determined by performing a route lookup on the original pre-NAT destination IP)
   • Original Source IP
   • Original Destination IP

2. Security Policy Match Criteria:

   • Original Source Zone
   • Original Source IP
   • Destination Zone: The egress zone determined by a route lookup of the pre-NAT destination IP address.
   • Destination IP: The Post-NAT (Translated) Destination IP address!

Key Exam Rule: In Security Policy rules for Destination NAT traffic, the Destination Zone is the zone where the pre-NAT destination IP routes, but the Destination IP address MUST be configured as the Post-NAT (real internal) IP address.

---

NAT Translation Method Comparison