{"id":487,"date":"2020-02-02T14:54:16","date_gmt":"2020-02-02T06:54:16","guid":{"rendered":"https:\/\/www.insecurewire.com\/?p=487"},"modified":"2020-02-02T14:54:16","modified_gmt":"2020-02-02T06:54:16","slug":"palo-alto-destination-u-turn-nat","status":"publish","type":"post","link":"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/","title":{"rendered":"Palo Alto Destination “U-TURN” NAT"},"content":{"rendered":"

Last week I was asked to configure access to a web app that sits within an isolated training environment. The first part of the ticket was to configure standard static NAT access to this web app. Simple one to one IP static NAT, no problems with that.<\/p>\n

The issue I faced arised when the web app needed to be accessed by its public (in this case WAN routeable) IP address from the same source zone. Student labs sit in the same zone as the server, although behind another L3 router (with its own ACLs). <\/p>\n

Below is a diagram of the issue:
\n\"u<\/a><\/p>\n

Essentially what we want to acheive here is to allow anything that is within the ISOLAB Zone access to the web server (192.168.1.100) using its “DMZ” address 10.161.53.230. To do that we have to create a destination nat policy rule on the Palo Alto:
\n\"PANOS<\/a><\/p>\n

So once the packet hits the default gateway of the DMZ zone (10.161.53.243) it is translated back to the web server (192.168.1.100) in the ISOLAB zone. Now access to the web app from the ISOLAB zone is via http:\/\/10.161.53.230 from within the ISOLAB zone. <\/p>\n

There is no need for a security policy rule as the traffic is all within the same zone. NAT concepts can get very confusing, one of my tricks is to always think about the ‘original’ source packet as that is what NAT translates. the PA NAT policy screen on the Web GUI depicts this in a very clear manner.<\/p>\n","protected":false},"excerpt":{"rendered":"

Last week I was asked to configure access to a web app that sits within an isolated training environment. The first part of the ticket…<\/p>\n","protected":false},"author":2,"featured_media":368,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[28,5],"tags":[91,133,139,181],"class_list":["post-487","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-firewall","category-palo-alto-networks","tag-dnat","tag-nat","tag-palo-alto","tag-u-turn"],"acf":[],"yoast_head":"\nPalo Alto Destination "U-TURN" NAT - Insecure Wire<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Palo Alto Destination "U-TURN" NAT - Insecure Wire\" \/>\n<meta property=\"og:description\" content=\"Last week I was asked to configure access to a web app that sits within an isolated training environment. The first part of the ticket...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/\" \/>\n<meta property=\"og:site_name\" content=\"Insecure Wire\" \/>\n<meta property=\"article:published_time\" content=\"2020-02-02T06:54:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2019\/10\/kisspng-palo-alto-networks-logo-computer-security-network-index-of-wp-contentuploadsbackup2-17-9-5bfe2d7806fc37.2475270015433844400286.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1357\" \/>\n\t<meta property=\"og:image:height\" content=\"680\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"nikonau\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/insecurewire\" \/>\n<meta name=\"twitter:site\" content=\"@insecurewire\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"nikonau\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/\"},\"author\":{\"name\":\"nikonau\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d\"},\"headline\":\"Palo Alto Destination “U-TURN” NAT\",\"datePublished\":\"2020-02-02T06:54:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/\"},\"wordCount\":249,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.insecurewi.re\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2019\/10\/kisspng-palo-alto-networks-logo-computer-security-network-index-of-wp-contentuploadsbackup2-17-9-5bfe2d7806fc37.2475270015433844400286.png\",\"keywords\":[\"DNAT\",\"NAT\",\"Palo Alto\",\"U-Turn\"],\"articleSection\":[\"Firewall\",\"Palo Alto Networks\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/\",\"url\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/\",\"name\":\"Palo Alto Destination \\\"U-TURN\\\" NAT - Insecure Wire\",\"isPartOf\":{\"@id\":\"https:\/\/www.insecurewi.re\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2019\/10\/kisspng-palo-alto-networks-logo-computer-security-network-index-of-wp-contentuploadsbackup2-17-9-5bfe2d7806fc37.2475270015433844400286.png\",\"datePublished\":\"2020-02-02T06:54:16+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#primaryimage\",\"url\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2019\/10\/kisspng-palo-alto-networks-logo-computer-security-network-index-of-wp-contentuploadsbackup2-17-9-5bfe2d7806fc37.2475270015433844400286.png\",\"contentUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2019\/10\/kisspng-palo-alto-networks-logo-computer-security-network-index-of-wp-contentuploadsbackup2-17-9-5bfe2d7806fc37.2475270015433844400286.png\",\"width\":1357,\"height\":680,\"caption\":\"Palo Alto Networks\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.insecurewi.re\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Palo Alto Destination “U-TURN” NAT\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.insecurewi.re\/#website\",\"url\":\"https:\/\/www.insecurewi.re\/\",\"name\":\"Insecure Wire\",\"description\":\"A Network Engineer\u2019s Perspective.\",\"publisher\":{\"@id\":\"https:\/\/www.insecurewi.re\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.insecurewi.re\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.insecurewi.re\/#organization\",\"name\":\"Insecure Wire\",\"url\":\"https:\/\/www.insecurewi.re\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png\",\"contentUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png\",\"width\":32,\"height\":32,\"caption\":\"Insecure Wire\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/insecurewire\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d\",\"name\":\"nikonau\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g\",\"caption\":\"nikonau\"},\"sameAs\":[\"https:\/\/x.com\/https:\/\/twitter.com\/insecurewire\"],\"url\":\"https:\/\/www.insecurewi.re\/index.php\/author\/nikon\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Palo Alto Destination \"U-TURN\" NAT - Insecure Wire","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/","og_locale":"en_US","og_type":"article","og_title":"Palo Alto Destination \"U-TURN\" NAT - Insecure Wire","og_description":"Last week I was asked to configure access to a web app that sits within an isolated training environment. The first part of the ticket...","og_url":"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/","og_site_name":"Insecure Wire","article_published_time":"2020-02-02T06:54:16+00:00","og_image":[{"width":1357,"height":680,"url":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2019\/10\/kisspng-palo-alto-networks-logo-computer-security-network-index-of-wp-contentuploadsbackup2-17-9-5bfe2d7806fc37.2475270015433844400286.png","type":"image\/png"}],"author":"nikonau","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/insecurewire","twitter_site":"@insecurewire","twitter_misc":{"Written by":"nikonau","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#article","isPartOf":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/"},"author":{"name":"nikonau","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d"},"headline":"Palo Alto Destination “U-TURN” NAT","datePublished":"2020-02-02T06:54:16+00:00","mainEntityOfPage":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/"},"wordCount":249,"commentCount":0,"publisher":{"@id":"https:\/\/www.insecurewi.re\/#organization"},"image":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#primaryimage"},"thumbnailUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2019\/10\/kisspng-palo-alto-networks-logo-computer-security-network-index-of-wp-contentuploadsbackup2-17-9-5bfe2d7806fc37.2475270015433844400286.png","keywords":["DNAT","NAT","Palo Alto","U-Turn"],"articleSection":["Firewall","Palo Alto Networks"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/","url":"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/","name":"Palo Alto Destination \"U-TURN\" NAT - Insecure Wire","isPartOf":{"@id":"https:\/\/www.insecurewi.re\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#primaryimage"},"image":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#primaryimage"},"thumbnailUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2019\/10\/kisspng-palo-alto-networks-logo-computer-security-network-index-of-wp-contentuploadsbackup2-17-9-5bfe2d7806fc37.2475270015433844400286.png","datePublished":"2020-02-02T06:54:16+00:00","breadcrumb":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#primaryimage","url":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2019\/10\/kisspng-palo-alto-networks-logo-computer-security-network-index-of-wp-contentuploadsbackup2-17-9-5bfe2d7806fc37.2475270015433844400286.png","contentUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2019\/10\/kisspng-palo-alto-networks-logo-computer-security-network-index-of-wp-contentuploadsbackup2-17-9-5bfe2d7806fc37.2475270015433844400286.png","width":1357,"height":680,"caption":"Palo Alto Networks"},{"@type":"BreadcrumbList","@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/02\/02\/palo-alto-destination-u-turn-nat\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.insecurewi.re\/"},{"@type":"ListItem","position":2,"name":"Palo Alto Destination “U-TURN” NAT"}]},{"@type":"WebSite","@id":"https:\/\/www.insecurewi.re\/#website","url":"https:\/\/www.insecurewi.re\/","name":"Insecure Wire","description":"A Network Engineer\u2019s Perspective.","publisher":{"@id":"https:\/\/www.insecurewi.re\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.insecurewi.re\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.insecurewi.re\/#organization","name":"Insecure Wire","url":"https:\/\/www.insecurewi.re\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/","url":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png","contentUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png","width":32,"height":32,"caption":"Insecure Wire"},"image":{"@id":"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/insecurewire"]},{"@type":"Person","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d","name":"nikonau","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g","caption":"nikonau"},"sameAs":["https:\/\/x.com\/https:\/\/twitter.com\/insecurewire"],"url":"https:\/\/www.insecurewi.re\/index.php\/author\/nikon\/"}]}},"_links":{"self":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts\/487","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/comments?post=487"}],"version-history":[{"count":0,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts\/487\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/media\/368"}],"wp:attachment":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/media?parent=487"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/categories?post=487"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/tags?post=487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}