![](https://scientia-potentia-est.com/wp-content/uploads/2023/06/PANAT.png)
目錄
架設環境
先確認你的PC跟你要做NAT的VM有相同網卡可以通。
架構
![](https://scientia-potentia-est.com/wp-content/uploads/PaloAltoNATSetup/NAT_Architecture.jpg)
NAT Zone 設定
到Network→Zones,先把整個NAT過程需要的zones新增起來。
![](https://scientia-potentia-est.com/wp-content/uploads/PaloAltoNATSetup/PANATZone.jpg)
我採用的架構就只需要內外腳的trust、untrust這兩個zone。
![](https://scientia-potentia-est.com/wp-content/uploads/PaloAltoNATSetup/PANATZoneSetting.jpg)
trust是跟內部溝通的內腳,untrust是需要連到外網的外腳。
NAT Interface Inner & Outer
到Network→Interfaces設定NAT的內腳與外腳,下面有Add選項
![](https://scientia-potentia-est.com/wp-content/uploads/PaloAltoNATSetup/PANATInterface.jpg)
Virtual Routers Setup
到Network→Virtual Routers新增一個新的Router
![](https://scientia-potentia-est.com/wp-content/uploads/PaloAltoNATSetup/VirtualRoute.jpg)
在Router Settings選擇內外腳的Interface
![](https://scientia-potentia-est.com/wp-content/uploads/PaloAltoNATSetup/PANATRouterInterface.jpg)
到Static Routes新增下一跳,Add一個新的路徑
![](https://scientia-potentia-est.com/wp-content/uploads/PaloAltoNATSetup/PANATVirtualRoute.jpg)
default使用0.0.0.0/0代表轉any,然後下一跳轉default-gateway
![](https://scientia-potentia-est.com/wp-content/uploads/PaloAltoNATSetup/PAStaticRoutes.jpg)
![](https://scientia-potentia-est.com/wp-content/uploads/PaloAltoNATSetup/PANATNextHop.jpg)
NAT Policy
接著到Policy選NAT
![](https://scientia-potentia-est.com/wp-content/uploads/PaloAltoNATSetup/PANATPolicy.jpg)
Add新增新的NAT Policy,General輸入名稱,Source是我內腳,連我的trust到外部的untrust
![](https://scientia-potentia-est.com/wp-content/uploads/PaloAltoNATSetup/PANATPolicySetting.jpg)
Translate Packet連我外腳,使用Dynamic IP and Port轉出去
![](https://scientia-potentia-est.com/wp-content/uploads/PaloAltoNATSetup/PANATPolicyDynamic.jpg)
測試結果
若要測試是否有轉譯成功,可以嘗試連接網頁,先把Policy的Any打開,讓http/https通過,接著網卡那邊也要設定DNS Server的位置,不然找不到網頁位置,連接網頁過防火牆,可以在Log裡面看到有Source IP以及NAT Dest IP,就代表轉譯成功
![](https://scientia-potentia-est.com/wp-content/uploads/PaloAltoNATSetup/PANATLogs.jpg)