In this DNAT setup, HTTP and SSH traffic are directed to specific servers in the DMZ. The configuration ensures precise policy rules align with the DNAT mapping.

Rule C: Allows HTTP (web-browsing application) traffic from the Untrust zone to the DMZ. The NAT configuration maps this to Host A (10.1.1.100).

Rule D: Allows SSH traffic from the Untrust zone to the DMZ. The NAT configuration maps this to Host B (10.1.1.101).

This design segments and secures traffic while ensuring the correct mapping of applications to the servers. Both rules work in conjunction with the destination NAT policy to ensure seamless traffic flow and application-specific routing.

References:

Palo Alto Networks DNAT Configuration

Security Policies Best Practices