Palo Alto Firewall: Why is double NAT needed?

Question

The diagram shows my current network configuration. (Where X is 10).

I have the firewall interface E1/2 at the left configured to 192.168.10.1/24. It is in a trusted security zone. A DHCP server is configured at the ethernet 1/2 interface. Its range is 192.168.10.70 to 192.168.10.80. The PC at the gets the first IP address from the DHCP server of 192.168.10.70

E1/1 has an IP address of 172.16.1.110/24. It is in the untrusted security zone.

I have a virtual router routing between E1/1 and E1/2 as they in different networks with different network ID. The virtual router has a static default route with destination 0.0.0.0/0 and next hop IP address of 172.16.1.1. This is needed for traffic going to the internet.

I have a security policy to allow traffic from the Trust-L3 security zone to reach Untrust-L3 security zone.

The router just before the internet has NAT configured to translate the private IP address 172.16.1.110/24 to a public IP address.

At this point, the PC at the left can ping 192.168.10.1 (E/2) and 172.16.1.110 (E1/1). However it cannot ping 172.16.1.1 (internal-facing port of the router). It also cannot access the internet.

My question at this point is why can't it access the internet if NAT is already done at the router?

I learnt that by configuring a source NAT policy at the firewall to translate all packets from the untrust zone to have a source IP address of 172.16.1.110/24, it can fix this.

This means that an NAT is done at the firewall to translate a private IP address to another private IP address followed by the router's NAT to translate 172.16.1.110 to a public IP address. Only then can the PC reach the internet.

However, I do not understand why there must be a double NAT done as I always thought that NAT is only needed for a private IP address to a public IP address. Why is it that traffic exiting E1/1 cannot reach 172.16.1.1 without a source NAT?

Another related issue I have is that once configuring the source NAT, I can ping 172.16.1.1 and access the internet from the PC but can no longer ping 172.16.1.110.

Answer 1

Apparently, your border router (BR) doesn't know 192.168.x. network. It only knows 172.16.1.0 network and how to route it.

Also, Palo Alto has demarked 192.168.x space as private (secured) so it doesn't want to see that traffic sourced in from untrusted interface.

Hope this helps.

Answer 2

Double NAT in this situation would not be a viable solution. This is somewhat of a non-ideal network setup but I am guessing based on the information you have provided you are using some type of business internet connection via your ISP which requires you to share the /24 on that untrust side of your PAN. Keeping this design simple would make your life a lot easier, IE use one NAT on your router if you manage this device, or NAT on the PAN.

In our environment we NAT at the Palo Alto. As mentioned above your issue was not NAT it was lack of awareness between the "edge" routers route table and the trust network.

If you want to make this super simple, like Barney simple, configure a static route between your router pointing at the Palo untrust interface with the destination of 192.168.10.0/24 being the destination and a default route for 0.0.0.0 via 172.16.1.1 on the Palo Alto side.

Here is an example config from one of our sites with a similar but more ideal and simple configuration.

enter image description here