NAT Active/Active HA Binding Tab

•	Policies > NAT > Active/Active HA Binding

The Active/Active HA Binding tab is available only if the firewall is in a high availability (HA) active/active configuration. In this configuration, you must bind each source NAT rule (whether static or dynamic NAT) to Device ID 0 or Device ID 1; you must bind each destination NAT rule to either Device ID 0, Device ID 1, both (Device ID 0 and Device ID 1), or to the active-primary firewall.

Select an Active/Active HA Binding setting to bind the NAT rule to an HA firewall as follows:

•	0—Binds the NAT rule to the firewall that has HA Device ID 0.

•	1—Binds the NAT rule to the firewall that has HA Device ID 1.

•	both—Binds the NAT rule to both the firewall that has HA Device ID 0 and the firewall that has HA Device ID 1. This setting does not support Dynamic IP or Dynamic IP and Port NAT.

•	primary—Binds the NAT rule to the firewall that is in HA active-primary state. This setting does not support Dynamic IP or Dynamic IP and Port NAT.

You typically configure device-specific NAT rules when the two HA peers have unique NAT IP address pools.

When the firewall creates a new session, the HA binding determines which NAT rules the session can match. The binding must include the session owner for the rule to match. The session setup firewall performs the NAT rule matching but the session is compared to NAT rules that are bound to the session owner and translated according to one of the rules. For device-specific rules, the firewall skips all NAT rules that are not bound to the session owner. For example, suppose the firewall with Device ID 1 is the session owner and the session setup firewall. When Device ID 1 attempts to match a session to a NAT rule, it ignores all rules bound to Device ID 0.

If one peer fails, the second peer continues to process traffic for the synchronized sessions from the failed peer, including NAT translations. Palo Alto Networks recommends you create a duplicate NAT rule that is bound to the second Device ID. Therefore, there are two NAT rules with the same source translation addresses and the same destination translation addresses—one rule bound to each Device ID. This configuration allows the HA peer to perform new session setup tasks and perform NAT rule matching for NAT rules that are bound to its Device ID. Without a duplicate NAT rule, the functioning peer will try to perform the NAT policy match but the session won’t match the firewall’s own device-specific rules and the firewall skips all other NAT rules that are not bound to its Device ID.

Looking for more?

See NAT in Active/Active HA Mode

Parent topic 

Policies > NAT