Why using Dynamic ip and port when using U-Turn NAT

Question

I have a lab with a palo alto device in a deployment with a host and a server. I set up a mail server in a machine and finally I got all scenarios working fine. The most problematic connection has been when a LAN user in trust zone connect to mail server throught the public IP in untrust zone. Mail server is also in trust zone.

I could fix this scenario when reading this link https://live.paloaltonetworks.com/docs/DOC-1678 from palo alto. My problem was that I wasn't applying the source translation in the NAT rule.

In order to understand how NAT works, my question is, Why do you need to translate source address in U-Turn NAT scenario?

Kind regards

Answer 1

Because they're in the same zone -- and thus the same subnet, the source must be rewritten to get the replies to pass back through NAT instead of being a direct reply.

When a local lan client attempts to connect to the public server address, the traffic will flow to the firewall. The firewall will rewrite the destination and forward the traffic to the local lan server address. If the firewall doesn't change the source as well, the server will see the source as being on the local lan, and it's replies will be sent direct to the local lan client using the local lan server address. Without it passing back through the firewall, the traffic will not make sense to the client (wrong tcp sequence numbers, and wrong IP address.)