2

I believe I know the answer to my dilemma, but wanted to pick the NetworkStackExchange community brain.

We currently perform Twice NAT'ing for a affiliate we have a peer exchange point with using a Palo Alto security device, their device is a straight leg into a router. We do Twice NAT'ing to make it easier for them to distribute a single route-able subnet with in their network to reach our network and vice versa. The issue of overlapping subnets is coming up, and we are currently having issues with because we are using a single security device to perform the NAT'ing. I believe the issue is because the security device makes it's routing decision pre-NAT, based on the documentation found in Palo Alto's Understanding and Configuring NAT.

My question is the only way around overlapping IPs is to do source NAT'ing for each side on two devices?

network diagram

Thank you,

So if I initiate a ICMP ping like the depiction below I see the echo reply being routed back out the same interface it came in on.

  • try and not do this. It is over complicated. – Ronnie Royston Jun 9 '15 at 15:37
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 7 '17 at 20:12
2

I recommend you to print page 4 of this document because it's a handy tool for troubleshooting.

About packet flow in Palo Alto, check this grahp.

In your case, points of interest could summarize as:

  • PBF is checked.
  • Routing table lookup.
  • DST Nat rule checked.
  • Routing table lookup.
  • SRC Nat rule checked.
  • Security policy checked.

My question is the only way around overlapping IPs is to do source NAT'ing for each side on two devices?

We have to understand your network to propose a different approach. Maybe you could get same results with PBF.

Anyway, I think NAT it's the best approach. In this cases, I always use a 2 rule NAT in one of the peers (or reflexive policy in older PANOS versions). What's the problem with using NAT?

Edit 1:

I thought you just had overlapping network in both sides but onlye one networks wants to communicate with the other peer. The real scenario is that you have overlapping and you want communication between the two overlapping networks. This is a problem related with IP and not Palo Alto at all.

In this particular scenario I can't imagine other solution than tweak destination IP and make a NAT in Palo Alto device. Or obviously, you always can change IP adressing on one of the 2 overlapping networks :).

| improve this answer | |
  • Hi KorXo, I've added a picture to help depict the issue. I believe it is because we are using a single security device, the affiliate does not. – Jim Jun 9 '15 at 16:21
  • I misunderstand your initial scenario. I'll edit my answer. – KorXo Jun 10 '15 at 10:54
  • I ended up having to use a PBF to forward traffic originating on one side to be forced out the other. Palo Alto does a Post-NAT route lookup on all Destination based NATs – Jim May 9 '18 at 15:13
0

If the routing decision is pre-NAT, then I think it should work. (Exactly like you have on the ping diagram). If the ping is exiting on the same interface it goes in, it's because the routing is being executed after-NAT. Do you have the same result when ping is initiated by other side also?

| improve this answer | |
  • Yes I do. However from reading the documentation it seems it should be routing pre-NAT.... – Jim Jun 11 '15 at 21:56
  • As a test, I would try to remove the NAT rules and check if the ping exits on the correct interface. If it won't then it's other thing than the NAT that is causing it to be routed back. – pulsar12 Jun 13 '15 at 22:04
0

I see this post is fairly old and you may have found an answer already. But here is my solution for this sort of thing.

Double NATting as you designed it. However, to make it work, you will need to create two virtual routers and assign the interfaces on each side to different VRs and then configure NAT. It works and I have done it many times.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.