topic NAT Sanity Check in General Topics

NAT Sanity Check

newcollegedurham — Tue, 28 Nov 2023 20:53:02 GMT

Can I sanity check a NAT rule please. We have a small satellite office with a PA as the firewall. We only have /30 subnet so one IP for the router and one for the IP of the external NIC on the PA.

We need to have a connection for a service to a telephone system that comes from external to the telephone. So because of the IP limitation need to NAT behind the external interface. I've created an internal object for the IP address of the telephone, an object for the external IP of the FW NIC and a NAT rule. The zones are just LAN and WAN.

The NAT rule is as follows:

On the Original Packet tab

the Zone is Internal for the Source

On the Destination Zone is the WAN

Source address is the internal object IP address for the telephone

On the Translated Packet Tab

Translation Type is Static IP in Source address Translation

Translated address is the IP of the external NIC of the FW

Bi-directional is ticked Yes.

That should work and achieve what is required??

Thanks for any help, it is appreciated.

Re: NAT Sanity Check

aleksandar.astardzhiev — Wed, 29 Nov 2023 08:25:26 GMT

Hi @newcollegedurham ,

I am guessing you have also "default" source hide-NAT rule at the bottom, which will translate all internal networks to internet, is that correct? If yes, I am not sure if using the same public IP for static NAT and for dynamic ip and port (DIPP) will not cause commit error. I could be wrong, but I am trying to imagine how FW will handle the port mapping for each session.

Creating static source NAT with bi-directional will NAT will create destination NAT rule matching any destination port. I would suggest you to consider to create the inbound NAT rule manually instead of using the bi-directional feature.

- First benefit it will be visible in the GUI, so it will be easier to be spot

- Second benefit is that you can specify port or port range, which leaves you options to use the other available ports for future needs. This could be little tricky as you want to NAT telephone system, which will require some large port ranges.