Palo Alto NAT — Watch It, Click It, Get It in 12 Minutes

Before NAT — the one rule that confuses everyone

Palo Alto evaluates packets in this order: route lookup → NAT match → security policy match → translate → forward. The translation itself happens last, but the NAT rule is identified before the security policy runs.

One sentence to memorise: "Pre-NAT IP, post-NAT zone." Security rules use the original (pre-NAT) IP addresses but the destination zone after the route lookup figures out where the packet is going. Drill this in — it's a top-5 PCNSE question every cycle.

① Source NAT — many private IPs, one public face

Office mein 500 laptops sit behind one ISP link. They all share a single public IP 203.0.113.5. The firewall multiplexes them using port numbers — that's Dynamic IP and Port (DIPP), the most common NAT type on planet Earth.

The four Source-NAT translation types

② Destination NAT — publish an internal server

Reverse direction. The world types https://webapp.techclick.in, DNS resolves to 203.0.113.10, packet hits the firewall, firewall translates the destination to 10.50.5.10 on the DMZ.

③ U-Turn (Hairpin) NAT — the puzzle every L1 hits once

An employee at HQ types https://webapp.techclick.in (their own company's app, publicly published at 203.0.113.10). DNS resolves to the public IP. The packet leaves the laptop heading to the firewall. Without U-Turn NAT, the firewall sees source = inside (trust-lan), destination = its own public IP, no Dest-NAT rule for traffic-from-inside → goes haywire.

U-Turn fixes it by NAT'ing both the destination (public→private) AND the source (so the server sees the firewall as the originator, not the user's real IP — preserving symmetric return).

④ Troubleshoot — "NAT not working" playbook

You've configured a NAT rule. Traffic doesn't pass. Here's the 4-step diagnosis ladder — runs in under 60 seconds.

test nat-policy-match from trust-lan to untrust-wan source 192.168.10.50 destination 8.8.8.8 protocol 6 destination-port 443

NAT-Internet-Outbound {
    from        trust-lan;
    to          untrust-wan;
    source      [ corp-clients ];
    destination [ any ];
    service      any;
    nat-type    ipv4;
    to-interface  ethernet1/2;
    source-translation: dynamic-ip-and-port (interface-address)
}

DIPP port exhaustion — the silent throughput killer

One public IP = ~64K ports available. 5,000 users with ~10 sessions each = 50,000 NAT'd flows = perilously close to the wall. Once you exhaust the port pool, new sessions get dropped with no clear error message. Counter to watch: nat_dyn_port_xlat_full.