topic Source and destination both NAT required for inbound connection on Azure... in VM-Series in the Public Cloud

Source and destination both NAT required for inbound connection on Azure...

omprasadax — Wed, 28 Apr 2021 04:24:39 GMT

Hi Team,

On public cloud Azure, why we need to translate source address also for Destination NAT?

When i am translating source with trust interface IP it is working fine but when i am keeping the address as original it is not working.

Kindly let me know is there any limitation on Public cloud for that we require source translation as well?

Regards,

Om Prasad

Re: Source and destination both NAT required for inbound connection on Azure...

JoergSchuetter — Wed, 28 Apr 2021 05:47:22 GMT

Hello @omprasadax

This mainly depends on how the routing is configured. Azure is very kind and adds routes of peered vNets and so on. Unfortunately this is not what we need when using a NVA.

Check the effective route on the servers, and overwrite the routing accordingly. Asynchronous routing has to be prevented.

Re: Source and destination both NAT required for inbound connection on Azure...

jmeurer — Wed, 28 Apr 2021 12:23:59 GMT

It's due to the return path routing. If you were using a single firewall or an HA pair, you would need to have your 0/0 route pointing back to the firewall to maintain symmetry. Typically, it is recommended to use an App Gateway in front of the firewalls which can insert the XFF header if the traffic is HTTP.