enter image description here

The diagram shows my current network configuration. (Where X is 10).

I have the firewall interface E1/2 at the left configured to It is in a trusted security zone. A DHCP server is configured at the ethernet 1/2 interface. Its range is to The PC at the gets the first IP address from the DHCP server of

E1/1 has an IP address of It is in the untrusted security zone.

I have a virtual router routing between E1/1 and E1/2 as they in different networks with different network ID. The virtual router has a static default route with destination and next hop IP address of This is needed for traffic going to the internet.

I have a security policy to allow traffic from the Trust-L3 security zone to reach Untrust-L3 security zone.

The router just before the internet has NAT configured to translate the private IP address to a public IP address.

At this point, the PC at the left can ping (E/2) and (E1/1). However it cannot ping (internal-facing port of the router). It also cannot access the internet.

My question at this point is why can't it access the internet if NAT is already done at the router?

I learnt that by configuring a source NAT policy at the firewall to translate all packets from the untrust zone to have a source IP address of, it can fix this.

This means that an NAT is done at the firewall to translate a private IP address to another private IP address followed by the router's NAT to translate to a public IP address. Only then can the PC reach the internet.

However, I do not understand why there must be a double NAT done as I always thought that NAT is only needed for a private IP address to a public IP address. Why is it that traffic exiting E1/1 cannot reach without a source NAT?

Another related issue I have is that once configuring the source NAT, I can ping and access the internet from the PC but can no longer ping

  • 2
    Double-NAT is not needed, and it should not be used. Routers need to know where to send traffic. Routers inherently know about directly-connected networks, but the need to be told where other networks are, either with static routing entries, or dynamically using a routing protocol. Either put in a static route to the network on the other side of the firewall, or configure the router and firewall to use a routing protocol to exchange network information.
    – Ron Maupin
    May 1, 2021 at 16:12
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Dec 23, 2021 at 19:16

2 Answers 2


Apparently, your border router (BR) doesn't know 192.168.x. network. It only knows network and how to route it.

Also, Palo Alto has demarked 192.168.x space as private (secured) so it doesn't want to see that traffic sourced in from untrusted interface.

Hope this helps.


Double NAT in this situation would not be a viable solution. This is somewhat of a non-ideal network setup but I am guessing based on the information you have provided you are using some type of business internet connection via your ISP which requires you to share the /24 on that untrust side of your PAN. Keeping this design simple would make your life a lot easier, IE use one NAT on your router if you manage this device, or NAT on the PAN.

In our environment we NAT at the Palo Alto. As mentioned above your issue was not NAT it was lack of awareness between the "edge" routers route table and the trust network.

If you want to make this super simple, like Barney simple, configure a static route between your router pointing at the Palo untrust interface with the destination of being the destination and a default route for via on the Palo Alto side.

Here is an example config from one of our sites with a similar but more ideal and simple configuration.

NAT original packet

enter image description here

enter image description here

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.