CloudLabBox
Try the free demo

Palo Alto NGFW lab 7 of 30

NAT: source, destination, port translation and U-turn

Build every NAT type an exam expects: dynamic IP and port for users, a bidirectional static NAT for a server's own outbound traffic, destination NAT with port translation to publish the intranet, and U-turn access for inside users. Learn the pre-NAT address, post-NAT zone rule for security policy and prove each translation in the session table.

Run this lab

It needs Lite: its 4 nodes are set to 5 vCPU and 7,680 MB in total. That fits the free demo too.

In your workspace: Shared, then Palo Alto NGFW PAN-OS 11 guided labs, then 07 - NAT - source destination port translation and U-turn

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
5 vCPU, 7,680 MB
Smallest plan
Lite

The scenario

The security rules allow depot users out to the internet, yet nothing works: the ISP routes only Calder's public block 203.0.113.0/24, and the test sites have no route back to 10.1.1.0/24. Calder needs:

NeedNAT typePublic address
Users browse the internetSource NAT, dynamic IP and port (PAT)203.0.113.2 (the interface)
web01 fetches its own updates from a fixed address the vendor can allow-listStatic source NAT, bidirectional203.0.113.10
Customers reach the intranet page from the internet at http://203.0.113.20:8080Destination NAT with port translation203.0.113.20:8080 to web01:80
Depot staff use the same public URL from insideU-turn203.0.113.20:8080

The Internet node is your customer: on its console, curl --interface 198.51.100.10 ... makes requests from a real internet address. Logins: FW1 admin / Lab-Access-1.

Before you start. Start all the nodes. The firewall takes 6-8 minutes to boot and comes up with this lab's starting configuration already loaded. Wait until the FW1 console shows FW1 login:, then log in as admin / Lab-Access-1. Until the management plane is ready it answers Login incorrect, even with the right password. The Linux hosts are ready within seconds.

What you’ll practise

  • Configure source NAT with dynamic IP and port on the egress interface
  • Configure a static bidirectional source NAT for a server
  • Publish a DMZ server with destination NAT and port translation
  • Write the matching security rule with the pre-NAT address and the post-NAT zone
  • Make the public address work from inside (U-turn) and verify with test nat-policy-match and the session table

The tasks

  1. Source NAT for depot users
  2. Static bidirectional NAT for web01's own traffic
  3. Publish the intranet with destination NAT and port translation
  4. U-turn: the public URL from inside
  5. Test NAT without traffic

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of NAT - source destination port translation and U-turn4 nodes and 3 networks, 7 links. Every link is listed as text below the diagram.FW1Client-PCweb01InternetInsideOutsideDMZeth0ethernet1/3eth0mgmtethernet1/2eth0ethernet1/1
4 nodes and 3 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • FW1 mgmt to Inside (network)
  • FW1 ethernet1/1 to Outside (network)
  • FW1 ethernet1/2 to Inside (network)
  • FW1 ethernet1/3 to DMZ (network)
  • Client-PC eth0 to Inside (network)
  • web01 eth0 to DMZ (network)
  • Internet eth0 to Outside (network)
Nodes in NAT: source, destination, port translation and U-turn, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
FW1Palo Alto Networks VM-Series (PAN-OS)paloalto-11.2.52 vCPU, 5,632 MB
Client-PCEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
web01EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 512 MB
InternetEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Palo Alto NGFW PAN-OS 11 guided labs.

  3. Open 07 - NAT - source destination port translation and U-turn and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Palo Alto NGFW labs

All Palo Alto NGFW labs

Related labs in other courses

CloudLabBox is independent of Palo Alto Networks and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.