{"id":639,"date":"2022-05-07T20:09:54","date_gmt":"2022-05-08T00:09:54","guid":{"rendered":"https:\/\/pressbooks.bccampus.ca\/paloalto\/?post_type=chapter&p=639"},"modified":"2026-02-18T15:35:42","modified_gmt":"2026-02-18T20:35:42","slug":"snat","status":"publish","type":"chapter","link":"https:\/\/pressbooks.bccampus.ca\/paloalto\/chapter\/snat\/","title":{"raw":"1.3 SNAT","rendered":"1.3 SNAT"},"content":{"raw":"
\r\n

Learning Objectives<\/p>\r\n\r\n<\/header>\r\n

\r\n
    \r\n \t
  • Configure Source NAT (SNAT)<\/li>\r\n<\/ul>\r\n<\/div>\r\n<\/div>\r\n
    \r\n\r\nPrerequisites<\/strong>:\r\n
      \r\n \t
    • Security policy for Inside to Outside<\/li>\r\n \t
    • Interface configuration<\/li>\r\n \t
    • Knowledge of previous labs<\/li>\r\n<\/ul>\r\n<\/div>\r\n
      Scenario<\/strong>: Source NAT is what your router does on a daily basis to provide you with Internet access just so you can go on social media and complain about how slow your internet is. Your router at home does this all automatically for you. But since we're real network engineers with a firewall on one hand, and determination on the other. Let's learn how to configure this all by ourselves using Palo Alto! We've already configured this in the previous chapter, so let's just go over it again!<\/div>\r\n\r\n[caption id=\"attachment_1339\" align=\"aligncenter\" width=\"852\"]\"\" Figure 1.49: Main Scenario<\/span>[\/caption]\r\n\r\n\r\n\r\n\r\n\r\n\r\n
      Table 1.4: Addressing Table<\/caption>\r\n
      Device<\/th>\r\nConfiguration<\/th>\r\n<\/tr>\r\n
      Client<\/span><\/td>\r\neth0: 10.0.0.2\/24 GW: 10.0.0.1 DNS: 8.8.8.8<\/td>\r\n<\/tr>\r\n
      PaloAlto<\/td>\r\nEthernet1\/1: 10.0.0.1\/24\r\nEthernet1\/2: DHCP\r\nManagement: 192.168.0.1\/24<\/td>\r\n<\/tr>\r\n
      Management (WebTerm)<\/td>\r\neth0: 192.168.0.2\/24<\/td>\r\n<\/tr>\r\n
      Outside (WebTerm)<\/td>\r\neth0: DHCP<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n\r\n\r\n\r\n\r\n
      Table 1.5: Zone Configuration<\/caption>\r\n
      Zone<\/th>\r\nInterface<\/th>\r\n<\/tr>\r\n
      Inside<\/td>\r\nEthernet1\/1<\/td>\r\n<\/tr>\r\n
      Outside<\/td>\r\nEthernet1\/2<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n

      SNAT (Source NAT: Access the Internet in Palo Alto)<\/h2>\r\nUnder the policies tab, go to NAT, then click Add.\r\n\r\n[caption id=\"attachment_642\" align=\"aligncenter\" width=\"1026\"]\"Set Figure 1.50: Set a Source NAT[\/caption]\r\n\r\nWe want to translate packets originating from the Inside to go to the outside zone using the interface address of ethernet1\/2. This would be Port Address Translation Overload. Under the General tab, just change the name.\r\n\r\n[caption id=\"attachment_643\" align=\"aligncenter\" width=\"1026\"]\"Set Figure 1.51: Set a Name for NAT[\/caption]\r\n\r\nUnder the original packet tab, click add then make the source zone inside. As for the destination zone, make it outside.\r\n\r\n[caption id=\"attachment_644\" align=\"aligncenter\" width=\"1026\"]\"Set Figure 1.52: Set a Source Zone and Destination Zone for NAT[\/caption]\r\n\r\nConfigure these settings under the translated packet tab in the source address translation<\/strong> area:\r\n\r\n\r\n\r\n\r\n\r\n\r\n
      Table 1.6: SNAT Configuration<\/caption>\r\n
      Parameter<\/th>\r\nValue<\/th>\r\n<\/tr>\r\n
      Translation Type<\/td>\r\nDynamic IP and Port<\/td>\r\n<\/tr>\r\n
      Address Type<\/td>\r\nInterface Address<\/td>\r\n<\/tr>\r\n
      Interface<\/td>\r\nEthernet1\/2<\/td>\r\n<\/tr>\r\n
      IP Address<\/td>\r\nNone<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n[caption id=\"attachment_645\" align=\"aligncenter\" width=\"1026\"]\"Set Figure 1.53: Set a Translated Packet[\/caption]\r\n\r\nDon't forget to commit!\r\n

      Check Internet Connectivity on Webterm<\/h2>\r\nOpen up webterm, and navigate to any website of your choosing.\r\n\r\n[caption id=\"attachment_646\" align=\"aligncenter\" width=\"1026\"]\"Verify Figure 1.54: Verify your connectivity to the Internet[\/caption]\r\n\r\nIf your desired webpage showed up, you have successfully configured SNAT!","rendered":"
      \n
      \n

      Learning Objectives<\/p>\n<\/header>\n

      \n
        \n
      • Configure Source NAT (SNAT)<\/li>\n<\/ul>\n<\/div>\n<\/div>\n
        \n

        Prerequisites<\/strong>:<\/p>\n

          \n
        • Security policy for Inside to Outside<\/li>\n
        • Interface configuration<\/li>\n
        • Knowledge of previous labs<\/li>\n<\/ul>\n<\/div>\n
          Scenario<\/strong>: Source NAT is what your router does on a daily basis to provide you with Internet access just so you can go on social media and complain about how slow your internet is. Your router at home does this all automatically for you. But since we’re real network engineers with a firewall on one hand, and determination on the other. Let’s learn how to configure this all by ourselves using Palo Alto! We’ve already configured this in the previous chapter, so let’s just go over it again!<\/div>\n
          \"\"
          Figure 1.49: Main Scenario<\/span><\/figcaption><\/figure>\n\n\n\n\n\n\n\n
          Table 1.4: Addressing Table<\/caption>\n
          Device<\/th>\nConfiguration<\/th>\n<\/tr>\n
          Client<\/span><\/td>\neth0: 10.0.0.2\/24 GW: 10.0.0.1 DNS: 8.8.8.8<\/td>\n<\/tr>\n
          PaloAlto<\/td>\nEthernet1\/1: 10.0.0.1\/24
          \nEthernet1\/2: DHCP
          \nManagement: 192.168.0.1\/24<\/td>\n<\/tr>\n
          Management (WebTerm)<\/td>\neth0: 192.168.0.2\/24<\/td>\n<\/tr>\n
          Outside (WebTerm)<\/td>\neth0: DHCP<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n\n\n
          Table 1.5: Zone Configuration<\/caption>\n
          Zone<\/th>\nInterface<\/th>\n<\/tr>\n
          Inside<\/td>\nEthernet1\/1<\/td>\n<\/tr>\n
          Outside<\/td>\nEthernet1\/2<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          SNAT (Source NAT: Access the Internet in Palo Alto)<\/h2>\n

          Under the policies tab, go to NAT, then click Add.<\/p>\n

          \"Set
          Figure 1.50: Set a Source NAT<\/figcaption><\/figure>\n

          We want to translate packets originating from the Inside to go to the outside zone using the interface address of ethernet1\/2. This would be Port Address Translation Overload. Under the General tab, just change the name.<\/p>\n

          \"Set
          Figure 1.51: Set a Name for NAT<\/figcaption><\/figure>\n

          Under the original packet tab, click add then make the source zone inside. As for the destination zone, make it outside.<\/p>\n

          \"Set
          Figure 1.52: Set a Source Zone and Destination Zone for NAT<\/figcaption><\/figure>\n

          Configure these settings under the translated packet tab in the source address translation<\/strong> area:<\/p>\n\n\n\n\n\n\n\n
          Table 1.6: SNAT Configuration<\/caption>\n
          Parameter<\/th>\nValue<\/th>\n<\/tr>\n
          Translation Type<\/td>\nDynamic IP and Port<\/td>\n<\/tr>\n
          Address Type<\/td>\nInterface Address<\/td>\n<\/tr>\n
          Interface<\/td>\nEthernet1\/2<\/td>\n<\/tr>\n
          IP Address<\/td>\nNone<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
          \"Set
          Figure 1.53: Set a Translated Packet<\/figcaption><\/figure>\n

          Don’t forget to commit!<\/p>\n

          Check Internet Connectivity on Webterm<\/h2>\n

          Open up webterm, and navigate to any website of your choosing.<\/p>\n

          \"Verify
          Figure 1.54: Verify your connectivity to the Internet<\/figcaption><\/figure>\n

          If your desired webpage showed up, you have successfully configured SNAT!<\/p>\n","protected":false},"author":1572,"menu_order":3,"template":"","meta":{"pb_show_title":"on","pb_short_title":"","pb_subtitle":"","pb_authors":[],"pb_section_license":""},"chapter-type":[],"contributor":[],"license":[],"class_list":["post-639","chapter","type-chapter","status-publish","hentry"],"part":3,"_links":{"self":[{"href":"https:\/\/pressbooks.bccampus.ca\/paloalto\/wp-json\/pressbooks\/v2\/chapters\/639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pressbooks.bccampus.ca\/paloalto\/wp-json\/pressbooks\/v2\/chapters"}],"about":[{"href":"https:\/\/pressbooks.bccampus.ca\/paloalto\/wp-json\/wp\/v2\/types\/chapter"}],"author":[{"embeddable":true,"href":"https:\/\/pressbooks.bccampus.ca\/paloalto\/wp-json\/wp\/v2\/users\/1572"}],"version-history":[{"count":25,"href":"https:\/\/pressbooks.bccampus.ca\/paloalto\/wp-json\/pressbooks\/v2\/chapters\/639\/revisions"}],"predecessor-version":[{"id":1341,"href":"https:\/\/pressbooks.bccampus.ca\/paloalto\/wp-json\/pressbooks\/v2\/chapters\/639\/revisions\/1341"}],"part":[{"href":"https:\/\/pressbooks.bccampus.ca\/paloalto\/wp-json\/pressbooks\/v2\/parts\/3"}],"metadata":[{"href":"https:\/\/pressbooks.bccampus.ca\/paloalto\/wp-json\/pressbooks\/v2\/chapters\/639\/metadata\/"}],"wp:attachment":[{"href":"https:\/\/pressbooks.bccampus.ca\/paloalto\/wp-json\/wp\/v2\/media?parent=639"}],"wp:term":[{"taxonomy":"chapter-type","embeddable":true,"href":"https:\/\/pressbooks.bccampus.ca\/paloalto\/wp-json\/pressbooks\/v2\/chapter-type?post=639"},{"taxonomy":"contributor","embeddable":true,"href":"https:\/\/pressbooks.bccampus.ca\/paloalto\/wp-json\/wp\/v2\/contributor?post=639"},{"taxonomy":"license","embeddable":true,"href":"https:\/\/pressbooks.bccampus.ca\/paloalto\/wp-json\/wp\/v2\/license?post=639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}