topic Re: NAT Multiple external IP's to a single inside host in General Topics

NAT Multiple external IP's to a single inside host

pan_concord — Fri, 30 Sep 2011 19:54:58 GMT

I'm trying to find documentation and/or any help to see if PAN firewalls are capable of NATing Two external IP's to a single host IP.

My scenario:

ISP1 204.23.123.123

----------> Internal host 10.10.10.10

ISP2 79.23.123.123

I have tried searching documentation as well as contacting support and I have not received any answers. I need to get this up quickly if possible. Any and all help is appreciated.

Re: NAT Multiple external IP's to a single inside host

skrall — Fri, 30 Sep 2011 23:13:30 GMT

The problem you will have is the return traffic. If the DEFAULT GATEWAY is ISP1, all of traffic from ISP2 will exit ISP1. I would suggest 2 virtual routers, one for each ISP so each canhave a separate default gateway. When you NAT the traffic inbound you will need to make the packets look like the original source was the LAN interface of the VR that processed the packet. The Server will basically see traffic from only 2 IP addresses so it will respond to the correct ISP. I have not tried this but it should be possible.

Steve Krall

Re: NAT Multiple external IP's to a single inside host

pan_concord — Mon, 03 Oct 2011 06:00:02 GMT

Thank you for the response. I understand how to create a virtual router. My other questions then are:

After creating the new virtual router for each ISP, how will I get all other traffic to exit the faster ISP interface?

Also, How would I configure the scenario you suggest? Would this be with policy based forwarding? "When you NAT the traffic inbound you will need to make the packets look like the original source was the LAN interface of the VR that processed the packet. The Server will basically see traffic from only 2 IP addresses so it will respond to the correct ISP. I have not tried this but it should be possible."

Again thank you for the insight and if there is documentation for me to read and configure. I'm happy to read it. I am still new with PAN firewalls, so I might not know what the correct procedures are, but I'm willing to put the time in to learn.

Re: NAT Multiple external IP's to a single inside host

LCMember406 — Mon, 03 Oct 2011 07:20:10 GMT

this is very easy , we have done this even with three ISPs not just two, all you have to do is to apply policy based routing on the internet router .