PBR & NAT

[dcanady55]

Hello,

FTD 7.3

If there's a better way to do the following, please let me know.

Current setup. I have a static route on our FTD that sends traffic A to a gateway off our DMZ interface. The traffic hits this third-party gateway, and then they NAT this before sending it out.

A third party asked if we could take on the NAT, but the IP after translation is something we use for traffic B. I've got two different types of traffic going to the same IP address now but using different ports. I need traffic A to go out of the DMZ interface and traffic B to go out of another interface, M-DMZ.

I created a PBR to accomplish the FTD, sending the traffic out its perspective interfaces based on an ACL matching the destination and port. A traffic to DMZ and B traffic to M-DMZ When tested, the B traffic worked fine, but the A traffic comes into the FTD using a destination of 1234, and I need to NAT this to 5678.

My question is: does NAT happen first before PBR, or should it go PBR, NAT, then ACL? During my test, my NAT counters never increased on my rule, so I'm thinking NAT might take place first, which would then make my PBR invalid as I setup my PBR with the original Destination IP vs. the new IP after NAT.

Thanks

[MHM Cisco World]

PBR before NATing' NAT command have two interface pbr specify outbound interface then NAT have inbound and outbound interface it can NATing traffic.

[MHM Cisco World]

Can I see FDM/FMC NAT you use 

[dcanady55]

I did some further testing over the weekend with no luck and found a trouble shooting FTD routing guide which I didn't come across before and that document has the following order of operations. If NAT comes first then my NAT and PBR config is incorrect and will reverse my config in tonight's test and let you know how it goes. 

The table summarizes how the FTD forwards packets in the data plane based on the interface mode. The forwarding mechanisms are listed in order of preference:

[MHM Cisco World]

Are this issue solved?

MHM