Twice NAT'ing and overlapping subnets

Question

I believe I know the answer to my dilemma, but wanted to pick the NetworkStackExchange community brain.

We currently perform Twice NAT'ing for a affiliate we have a peer exchange point with using a Palo Alto security device, their device is a straight leg into a router. We do Twice NAT'ing to make it easier for them to distribute a single route-able subnet with in their network to reach our network and vice versa. The issue of overlapping subnets is coming up, and we are currently having issues with because we are using a single security device to perform the NAT'ing. I believe the issue is because the security device makes it's routing decision pre-NAT, based on the documentation found in Palo Alto's Understanding and Configuring NAT.

My question is the only way around overlapping IPs is to do source NAT'ing for each side on two devices?

Thank you,

So if I initiate a ICMP ping like the depiction below I see the echo reply being routed back out the same interface it came in on.

Answer 1

I recommend you to print page 4 of this document because it's a handy tool for troubleshooting.

About packet flow in Palo Alto, check this grahp.

In your case, points of interest could summarize as:

• PBF is checked.
• Routing table lookup.
• DST Nat rule checked.
• Routing table lookup.
• SRC Nat rule checked.
• Security policy checked.

My question is the only way around overlapping IPs is to do source NAT'ing for each side on two devices?

We have to understand your network to propose a different approach. Maybe you could get same results with PBF.

Anyway, I think NAT it's the best approach. In this cases, I always use a 2 rule NAT in one of the peers (or reflexive policy in older PANOS versions). What's the problem with using NAT?

Edit 1:

I thought you just had overlapping network in both sides but onlye one networks wants to communicate with the other peer. The real scenario is that you have overlapping and you want communication between the two overlapping networks. This is a problem related with IP and not Palo Alto at all.

In this particular scenario I can't imagine other solution than tweak destination IP and make a NAT in Palo Alto device. Or obviously, you always can change IP adressing on one of the 2 overlapping networks :).

Answer 2

If the routing decision is pre-NAT, then I think it should work. (Exactly like you have on the ping diagram). If the ping is exiting on the same interface it goes in, it's because the routing is being executed after-NAT. Do you have the same result when ping is initiated by other side also?

Answer 3

I see this post is fairly old and you may have found an answer already. But here is my solution for this sort of thing.

Double NATting as you designed it. However, to make it work, you will need to create two virtual routers and assign the interfaces on each side to different VRs and then configure NAT. It works and I have done it many times.