topic Outbound NAT in General Topics

Outbound NAT

craymond — Mon, 21 May 2012 18:23:10 GMT

I am getting the error "Mismatch static-ip address range between original address and translated address" when I try to create a corporate outbound NAT rule. The rule is as follows:

trust -> untrust -> src (10.0.0.0/8) -> dest(any) -> src trans static IP (x.x.x.x/32) bi-directional (no)

Re: Outbound NAT

npare — Mon, 21 May 2012 18:43:12 GMT

Hi,

Static NAT is usually used for one-to-one addresses. Since your source is a /8 and destination /32, that can't work.

What you are probably trying to do is have your /8 network NAT to that single public address when goign to the internet, and to do that, you need dynamic NAT, not static NAT.

Your NAT translation object should look like this, but with the IP address configured. I can't do that on my firewall because the IP address of my internet facing interface is dynamic.

Re: Outbound NAT

craymond — Mon, 21 May 2012 18:51:23 GMT

Duh - Dynamic IP and port refers to the source - not destination. Just a little different then what I'm used to!

Thanks

Re: Outbound NAT

npare — Mon, 21 May 2012 19:01:09 GMT

I know what you mean, terminology can be quite different from one manufacturer to the other.

Happy to hear you got it working, let me know if you have more questions.