I have deployed a Palo Alto VM firewall on AWS for testing purposes with the following interface setup:

• WAN: ethernet1/1 (with an Elastic IP assigned)
• LAN: ethernet1/2

I want to create a NAT rule such that:

• When I access EIP:443, I reach the management port (this is working as expected).
• When I access EIP:4443, I want to be forwarded to an internal web server on port 443 (this is not working).

Here are the details of my current security and NAT policy configurations:

Security Rule:

Source Zone: WAN
Destination Zone: LAN
Source Address: Any
Destination Address: Internal HTTPS Server IP
Service: tcp/4443
Action: Allow

NAT Policy:

Original Packet:
Source Zone: WAN
Destination Zone: WAN
Destination Interface: ethernet1/1
Destination Address: EIP
Service: tcp/4443
Translated Packet:
Destination Address: Internal HTTPS Server IP
Service: tcp/443

Steps Taken:

• Verified the web server is reachable internally on port 443.
• Ensured that the web server has the correct security group settings in AWS (management interface is reachable) and the internal webserver as well on port 443 (webserver is reachable internally).
• Reviewed Palo Alto documentation and online resources for similar configuration examples.

Could anyone provide guidance on what might be wrong with my configuration or suggest additional troubleshooting steps? Any insights or examples of similar working configurations would be greatly appreciated.