When configuring a Destination NAT (DNAT) policy in PAN-OS with multiple translated IP addresses, the firewall requires a method to distribute incoming sessions across the address pool. "IP Modulo" is a session distribution method available in the "Translated Packet" tab. This algorithm uses the source IP address and the modulo operator to deterministically assign a session to a specific translated IP address. This ensures session persistence, meaning subsequent sessions from the same source IP will be directed to the same translated IP, which is crucial for stateful applications.

A. Destination IP Hash: The available option is "Source IP Hash," which uses the source IP, not the destination IP, for the hash calculation.

B. Concurrent Sessions: This is a metric used for monitoring session load, not a method for distributing new sessions across a NAT pool.

C. Max Sessions: This is a configurable limit to control the maximum number of sessions allowed, not a distribution algorithm.

1. Palo Alto Networks PAN-OS® Administrator's Guide 10.2: In the section describing NAT policy configuration

the "Translated Packet" tab options for Destination Address Translation are detailed. When using a pool of addresses

the "Distribution" field appears

which includes "IP Modulo" as a method to provide session persistence.

Reference: PAN-OS Administrator's Guide 10.2 > Policies > NAT > NAT Policy Rules > NAT Policy Rule Translation Tab. The guide states

"IP Modulo—The firewall uses the source IP address in the packet header as the key to select the translated destination IP address from the NAT pool. This ensures that sessions from the same source are always translated to the same destination address."

2. Palo Alto Networks Documentation Portal: The technical documentation for NAT Policy Rules explicitly lists the available session distribution methods.

Reference: Palo Alto Networks Docs > PAN-OS & Panorama > 10.2 > PAN-OS Administrator's Guide > NAT Policy Rule Translation Tab. This document lists the following distribution methods: Round-Robin

Source IP Hash

IP Modulo

Least Sessions

and Weighted Round-Robin. This confirms "IP Modulo" is a valid option and the others listed in the question are not.