How do hundreds of devices in an office share a single internet connection without running out of unique public addresses? Network Address Translation (NAT) is the clever method that maps private internal IP addresses to one or more public IP addresses, keeping internal networks secure and conserving the limited pool of global IPv4 addresses. For the PCNSA exam, you must understand how to configure NAT policies so that traffic flows correctly outbound and inbound through a Palo Alto Networks firewall.
Jump to a section
A simple way to picture Securing Traffic: Network Address Translation (NAT)
Because every device on a private network has an internal address that is meaningless on the public internet, Network Address Translation (NAT) acts like a reception desk in a large apartment building to solve that problem.
Think of a busy apartment building with many residents. Each resident has a unique apartment number (like a private IP address). But when a parcel or visitor arrives from the outside world, the delivery driver cannot find apartment 3B from the street. The building has a single street address (the public IP address) and a reception desk (the NAT device).
When a resident orders a pizza, they call the pizza place and give the building's street address. The delivery driver arrives at the lobby and hands the pizza to the receptionist. The receptionist checks a logbook to see which apartment ordered from that pizza place and then delivers the pizza to the correct apartment. When the resident sends a letter, they give it to the receptionist, who puts the building's return address on the envelope before mailing it.
If a resident wants a package delivered securely, the receptionist might unbox the package at the desk and rewrap it with a label that only the resident understands, so no one else in the building knows what is inside (a form of destination NAT called port forwarding). The reception desk never gives out individual apartment numbers to the outside world; it always translates requests so that internals stay private and externals see only the building's main address. This maps precisely to how a NAT gateway translates private IPs into a public IP for outbound traffic and how destination NAT translates incoming traffic to the correct internal server.
Network Address Translation (NAT) is a method used by the Palo Alto Networks firewall to change the source or destination IP address in a packet as it passes through the firewall. A packet is a small unit of data sent over a network, and an IP address is a numeric label assigned to each device on a network (like a postal address for a computer). Private IP addresses are addresses reserved for use inside a local network (such as 192.168.1.10) and cannot be routed on the public internet. Public IP addresses are globally unique addresses that can be used on the internet.
Why does NAT exist? There are two main reasons. First, the world is running out of IPv4 addresses (the most common type of IP address, with around 4.3 billion possible values). Without NAT, every device would need its own public IP address, which is impractical. Second, NAT provides a basic layer of security because it hides internal devices from the public internet. An external attacker cannot directly initiate a connection to a device that has a private IP address because the attacker only sees the public IP of the NAT device.
There are two main types of NAT you need to know for the PCNSA exam: Source NAT and Destination NAT.
Source NAT changes the source IP address of traffic leaving the internal network. Imagine a computer in the office with the private IP 10.0.0.5 sends a request to a web server on the internet at 8.8.8.8. The firewall receives this packet. Without NAT, the response from the web server would try to go back to 10.0.0.5, which is a private address that cannot be reached from the internet. With Source NAT, the firewall changes the source IP of the packet from 10.0.0.5 to the firewall's own public IP address (e.g., 203.0.113.100). The web server sends its response back to 203.0.113.100. The firewall then remembers which internal device made the request, reverses the translation, and forwards the response to 10.0.0.5. This process is called port address translation (PAT) when the firewall also changes the source port number to keep track of multiple connections from different internal devices. A port is a virtual point where network connections start and end, allowing a device to manage multiple simultaneous conversations.
Destination NAT changes the destination IP address of traffic coming from the internet to the internal network. This is commonly used to allow external users to access a server inside the office, such as a web server or email server. For example, you want people on the internet to reach your company's web server at the private IP 10.0.0.20 using your public IP 203.0.113.100. You create a Destination NAT policy that says: if an incoming packet is destined for IP 203.0.113.100 on port 80 (the standard port for web traffic), change the destination IP to 10.0.0.20 and the destination port to 80, then forward the packet to the internal server. This is also called port forwarding or static NAT when the translation is a one-to-one mapping between a public and private IP.
The Palo Alto Networks firewall uses a feature called U-turn NAT (also known as hairpin NAT or NAT loopback) to handle traffic from inside a network that is trying to reach a server on the same network using the server's public IP address. Without U-turn NAT, this traffic would go to the firewall, get its destination translated, but then fail because the firewall would not know how to route it back correctly.
NAT policies in Palo Alto are configured under the Policies tab and then NAT. A NAT policy consists of several key components:
Original Packet: The packet as it arrives at the firewall (before translation). This includes the source zone (where the traffic comes from), destination zone (where it is going), source IP, destination IP, and service (port).
Translated Packet: The changes to be applied to the packet (after translation). This is where you specify the new source IP, new destination IP, and optionally a new port.
The NAT type: source or destination.
The security policy: NAT policies work hand-in-hand with security policies. The security policy still must allow traffic for the connection to succeed. After NAT changes the packet, the security policy is evaluated using the pre-NAT or post-NAT information, depending on how you configure the rule.
A common pitfall is forgetting that NAT does not replace security policies. Even if a NAT translation is correct, the firewall will drop the traffic unless there is a corresponding security policy that allows the traffic based on the zones, IPs, and ports.
For the PCNSA exam, you must also understand the difference between static NAT (one-to-one, fixed mapping) and dynamic NAT (many-to-many, where the source IP is picked from a pool of addresses on the fly). Dynamic NAT is often used when you have a pool of public IPs that are shared among internal devices, although PAT is more common in modern networks because it allows many internal devices to share a single public IP.
NAT works at Layer 3 (the network layer) and Layer 4 (the transport layer) of the OSI model, which is a conceptual framework that standardises the functions of a telecommunication or computing system into seven layers. Layer 3 deals with IP addresses and routing, while Layer 4 deals with ports and TCP/UDP protocols. The firewall can translate IP addresses, ports, or both.
Define the traffic flow
Determine whether the traffic originates from inside the network going out (needs Source NAT) or from outside coming in (needs Destination NAT). Identify the source zone (e.g., trust) and destination zone (e.g., untrust), and the source/destination IPs and ports.
Create the NAT policy in Palo Alto
Go to Policies > NAT and click Add. Specify the original packet parameters (pre-NAT) such as source zone, destination zone, source IP, destination IP, and service. For Source NAT, set the translated source IP to the public IP or pool. For Destination NAT, set the translated destination IP to the internal server's IP.
Choose the NAT type
Select Static IP for one-to-one mapping, or Dynamic IP and Port (PAT) for many-to-one sharing. This choice depends on whether you have a pool of public IPs or just one. The PCNSA exam focuses on PAT as the most common outbound NAT type.
Create the corresponding security policy
After the NAT policy, create a security policy that allows the traffic. Use the post-NAT zones and IPs. For example, if the Destination NAT translates the destination to an internal server in the dmz zone, the security policy must permit traffic from untrust to dmz on the relevant service.
Test and verify the NAT translation
Use the Palo Alto firewall's 'Monitor > Logs > Traffic' to confirm that the NAT is applying correctly. Check the source and destination IPs in the log for both the pre-NAT and post-NAT fields. If traffic is dropped, examine the security policy logs to see if a deny rule is blocking the traffic.
Configure U-turn NAT if needed
If internal users need to access a server via its public IP, create an additional Destination NAT policy with the source zone set to the internal zone (e.g., trust) and the destination zone set to untrust, with the same translated destination IP as the external-facing rule. Ensure the security policy also allows the traffic from trust to the server's zone.
An IT professional at a mid-sized company called Acme Corp needs to configure NAT on the Palo Alto Networks firewall so that 200 employees can browse the internet securely and external partners can access the company's public-facing web server.
Step one: The network administrator reviews the existing network design. The office uses the private IP range 10.0.0.0/24 (a subnet of private addresses). The firewall's external interface has one public IP address: 203.0.113.100 assigned by the internet service provider (ISP). The internal employees are in the zone called 'trust', and the internet is in the zone called 'untrust'.
Step two: The admin configures a Source NAT policy. They go to Policies > NAT and click Add. They set the 'Original Packet' source zone to 'trust', destination zone to 'untrust', and leave the source and destination IP addresses as 'any' (meaning all internal traffic). For the 'Translated Packet', they set the source IP translation to 'Dynamic IP and Port' (which is PAT). The translated address is set to the public IP 203.0.113.100. They also add a security policy from trust to untrust that allows HTTP and HTTPS traffic (ports 80 and 443) from any internal user to any destination. After committing the change, all employees can browse the internet using the single public IP.
Step three: The admin needs to allow external partners to reach the company's web server, which has the private IP 10.0.0.50 and is in the zone called 'dmz' (a demilitarised zone, a separate network segment that sits between the internal network and the internet). The admin creates a Destination NAT policy. In the NAT rule, they set the 'Original Packet' source zone to 'untrust', destination zone to 'untrust' (because the packet arrives on the untrust interface), and the original destination IP to 203.0.113.100, destination port 443 (HTTPS). In the 'Translated Packet', they set the destination IP translation to 'Static IP', with the translated IP set to 10.0.0.50 and the translated port to 443.
Step four: The admin creates a corresponding security policy that allows traffic from untrust to dmz, source any, destination 10.0.0.50, service HTTPS. They also need to make sure the security rule is placed before any general 'deny all' rule.
Step five: The admin tests the configuration. They open a browser from outside the network and type https://203.0.113.100. The firewall receives the packet, applies the Destination NAT rule, changes the destination to 10.0.0.50, and then checks the security policy. Because the security policy allows the traffic, it forwards the packet to the web server. The web server responds, and the firewall reverses the translation for the reply so the external user sees the reply coming from 203.0.113.100.
Step six: The admin notices that internal users cannot access the web server using the public IP address (e.g., a user inside the office tries to browse to https://203.0.113.100). They realise they need to configure U-turn NAT. They add a second Destination NAT policy that applies when the source zone is 'trust', destination zone is 'untrust', and the original destination IP is 203.0.113.100 port 443. The translated packet again points to 10.0.0.50 port 443. They also add a security policy from trust to dmz allowing the traffic. After this, internal users can also access the web server using the public address.
Step seven: The admin ensures that the NAT policies are correctly ordered. The firewall processes NAT rules in order from top to bottom. If a policy that denies all traffic is placed above the NAT rule, the traffic will be dropped before NAT can translate it. The admin reviews the rule order and places the more specific NAT rules above any broader catch-all rules.
This real-world scenario shows the exact steps an IT professional takes to implement NAT for both outbound (source NAT) and inbound (destination NAT) traffic using a Palo Alto Networks firewall.
The PCNSA exam tests your understanding of NAT policy configuration, the difference between Source NAT and Destination NAT, and how they interact with security policies. Expect scenario-based questions where you must determine which type of NAT to use based on a description of traffic flow. Here are the key concepts the exam loves to test.
The exam will ask you to identify the correct NAT type for a given situation:
If traffic originates from an internal device and goes to the internet, you need Source NAT.
If traffic originates from the internet and goes to an internal server, you need Destination NAT.
Traps the exam sets include:
The exam might describe a scenario where an internal user needs to access a server using its public IP address. The correct answer is to use U-turn NAT (also called hairpin NAT or NAT loopback). A common wrong answer is to use a separate Destination NAT policy without U-turn, which would not work.
The exam might ask about the order of operations. On a Palo Alto firewall, the security policy is evaluated after the NAT translation if the security policy is set to match post-NAT IPs. This is a subtle but important detail. If the question says 'the firewall sees the original packet' or 'the firewall sees the translated packet', pay close attention.
The exam might present a scenario where the Source NAT uses 'Dynamic IP and Port' (PAT) versus 'Static IP'. Know that PAT allows many internal devices to share one public IP, while static NAT uses a one-to-one mapping.
Concepts to memorise for the exam:
The default behaviour for Source NAT when using 'Dynamic IP and Port' is to change the source port to a unique value above 1024.
A NAT policy requires a matching security policy to allow the traffic. The reverse is also true: a security policy alone does not perform translation.
The default zones on a Palo Alto firewall are 'trust' and 'untrust', but the exam will use custom zones in some questions.
The destination NAT can translate both the destination IP and the destination port. Source NAT translates the source IP and optionally the source port.
NAT policies can be applied per interface or globally, but in the PCNSA scope, you typically apply them to traffic between zones.
The exam will present multiple-choice questions with four options. Often, two options are obviously wrong (e.g., using source NAT for inbound traffic). The challenge is to distinguish between the remaining two correct-sounding options. One common trap is to forget the security policy. For example, a question describes a working NAT policy but the user still cannot reach the server. The correct answer is often that no security policy allows the traffic, or the security policy is placed in the wrong order.
Another trap is regarding the source and destination zones in the NAT rule. If an internal user (trust zone) tries to reach a web server on the DMZ using the server's public IP, the NAT rule's original packet must have the source zone as 'trust' and the destination zone as 'untrust' (because the destination IP is public). The security policy must allow traffic from trust to DMZ (the actual destination zone after translation). This mixing of zones in the NAT rule versus the security rule is a classic exam question.
Finally, the exam tests whether you know that NAT is not a security feature. It is an address translation mechanism. The firewall's security features (like App-ID, User-ID, Content-ID) work independently of NAT, although they analyse traffic after NAT translation by default.
Source NAT changes the source IP of outbound traffic to allow internal devices to communicate with the internet using a shared public IP.
Destination NAT changes the destination IP of inbound traffic to allow external users to reach internal servers, also known as port forwarding.
Every NAT policy on a Palo Alto firewall requires an associated security policy to explicitly allow the traffic to pass through the firewall.
Dynamic IP and Port (PAT) is the most common type of Source NAT and allows many internal devices to share a single public IP by changing source ports.
U-turn NAT (hairpin NAT) is required when an internal device accesses an internal server using the server's public IP address.
NAT policies are processed in order from top to bottom, so rule ordering is critical; a more specific rule should be placed above a general rule.
These come up on the exam all the time. Here's how to tell them apart.
Source NAT
Changes the source IP of outbound packets
Used for traffic leaving the internal network
Requires translation of the source port when using PAT
Destination NAT
Changes the destination IP of inbound packets
Used for traffic entering the internal network
Translates the destination port for specific services like HTTPS
Static NAT
One-to-one mapping between private and public IP
Each internal device gets a dedicated public IP
Commonly used for servers that must always be reachable at the same IP
Dynamic IP and Port (PAT)
Many-to-one mapping using port numbers
Multiple internal devices share a single public IP
Most common type of Source NAT for outbound user traffic
NAT Policy
Translates IP addresses and ports
Does not allow or deny traffic
Evaluated before security policy by default
Security Policy
Allows or denies traffic based on zones, IPs, and applications
Must exist for traffic to pass the firewall
Evaluated after NAT translation (post-NAT IPs are used)
U-turn NAT
Applies when source zone is internal (trust)
Destination zone is set to untrust in the original packet
Allows internal users to access servers via public IP
Standard Destination NAT
Applies when source zone is external (untrust)
Destination zone is untrust in the original packet
Allows external users to access internal servers via public IP
Mistake
NAT provides strong security because it hides internal IP addresses from the internet.
Correct
NAT provides only a weak, accidental security benefit. It is not a replacement for a stateful firewall with proper security policies. An attacker can still exploit vulnerabilities in applications that are accessible via Destination NAT.
Many beginners equate 'being hidden' with 'being safe'. But because NAT is not designed for security, it does not inspect traffic or block attacks. The PCNSA exam emphasises that security policies are what protect the network, not NAT.
Mistake
If I configure a Destination NAT policy, I do not need a separate security policy because the NAT already allows the traffic through.
Correct
A NAT policy only changes the IP addresses. A separate security policy is always required to allow the traffic to pass through the firewall.
The NAT rule and security rule are independent functions on the Palo Alto firewall. Beginners often assume translation implies permission, but the firewall's default action is to deny all traffic unless a security policy explicitly allows it.
Mistake
Source NAT and Destination NAT are mutually exclusive; a packet can only be translated by one or the other.
Correct
A single packet can be subject to both Source NAT and Destination NAT if it passes through two different NAT policies (e.g., traffic from one internal network to another internal network via the firewall).
This mistake comes from thinking of NAT as a single action. In reality, the firewall processes NAT rules in order and can apply multiple translations to the same packet, though this is less common in simple outbound/inbound scenarios.
Mistake
Dynamic IP and Port (PAT) assigns a different public IP address to each internal device.
Correct
PAT assigns unique source port numbers to each internal connection, allowing many internal devices to share a single public IP address.
The word 'dynamic' confuses beginners into thinking the public IP changes per device. In reality, the IP stays the same; it is the port that changes. The PCNSA exam tests this distinction directly.
Mistake
U-turn NAT is only needed if you have a server in the DMZ that external users access.
Correct
U-turn NAT is needed whenever an internal user tries to reach a server on the same network using the server's public IP address, regardless of whether the server is in the DMZ or even on the same internal subnet.
Beginners think U-turn NAT is an advanced feature only for DMZ servers. Actually, any scenario where internal traffic goes to a public IP that maps to an internal server (including a server on the same subnet) requires U-turn NAT. The exam often tests this as a trick question.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Source NAT changes the source IP of packets leaving your network so they appear to come from your public IP. Destination NAT changes the destination IP of packets entering your network so they are delivered to an internal server.
Yes. A NAT policy only translates IP addresses; a security policy is required to allow the traffic to pass through the firewall. Without a security policy, the firewall will drop the traffic even if the NAT is configured correctly.
PAT, or Dynamic IP and Port, maps many internal devices to a single public IP by changing the source port for each connection. Static NAT maps one internal IP to one public IP on a one-to-one basis. PAT conserves public IP addresses more efficiently.
U-turn NAT (also called hairpin NAT) allows internal devices to reach a server inside the same network using the server's public IP address. It is needed when a Destination NAT policy exists for external users, and internal users also need to access that server via the same public IP.
Go to Monitor > Logs > Traffic. Look for the session and examine the 'Source NAT' and 'Destination NAT' columns. You can also use the 'Test NAT' feature under Policies > NAT by entering source/destination IPs and ports to simulate the translation.
Yes. A packet can be translated by a Source NAT rule and a Destination NAT rule as it passes through the firewall, such as when traffic flows between two internal networks with different IP schemes. However, in typical internet-bound traffic, only one type is applied.
You've finished Securing Traffic: Network Address Translation (NAT). Continue through the PCNSA study guide to build a complete picture of the exam.
Done with this chapter?