! PermitANY — Palo Alto NAT Rules
! Source NAT (masquerade / IP pool), Destination NAT (DNAT/port-forwarding), and static NAT rules for Palo Alto PAN-OS firewalls.
! Generated: 2026-09-20
! These are EXAMPLE values. Replace with your actual config before deploying.
!
# Palo Alto NAT Rules — PA-FW-01
#
# Source NAT Rules

set {{../vsys}} rulebase nat rules "SNAT-LAN-to-Internet" from trust
set {{../vsys}} rulebase nat rules "SNAT-LAN-to-Internet" to untrust
set {{../vsys}} rulebase nat rules "SNAT-LAN-to-Internet" source Corp-LAN
set {{../vsys}} rulebase nat rules "SNAT-LAN-to-Internet" destination any
set {{../vsys}} rulebase nat rules "SNAT-LAN-to-Internet" nat-type ipv4
{{#if (eq snat_type "dynamic-ip-and-port")}}
set {{../vsys}} rulebase nat rules "SNAT-LAN-to-Internet" source-translation dynamic-ip-and-port interface-address interface ethernet1/1
{{/if}}
{{#if (eq snat_type "static-ip")}}
set {{../vsys}} rulebase nat rules "SNAT-LAN-to-Internet" source-translation static-ip translated-address 203.0.113.10
{{/if}}
{{#if (eq snat_type "dynamic-ip")}}
set {{../vsys}} rulebase nat rules "SNAT-LAN-to-Internet" source-translation dynamic-ip translated-address 203.0.113.10
{{/if}}

#
# Destination NAT Rules

set {{../vsys}} rulebase nat rules "DNAT-HTTPS-to-WebServer" from untrust
set {{../vsys}} rulebase nat rules "DNAT-HTTPS-to-WebServer" to untrust
set {{../vsys}} rulebase nat rules "DNAT-HTTPS-to-WebServer" destination 203.0.113.10
set {{../vsys}} rulebase nat rules "DNAT-HTTPS-to-WebServer" service service-https
set {{../vsys}} rulebase nat rules "DNAT-HTTPS-to-WebServer" destination-translation translated-address 192.168.1.10

set {{../vsys}} rulebase nat rules "DNAT-HTTPS-to-WebServer" destination-translation translated-port 8443


#
commit