topic Re: Many-to-One Destination NAT in General Topics

Many-to-One Destination NAT

Gurminder — Fri, 20 May 2016 09:44:19 GMT

Hi,

We currently have a problem on site where our windows domain name matches the website name so the naked domain DNS configuration contains an A record for a web server and not the domain controllers.

As a short term workaround (because it could take 2-3 years to plan and change the domain name) I'm using the destination NAT feature.

In my testing this has proved to work successfully; Changing the A record to match a domain controller so domain connected machines have no problem contacting them and the NAT will take care of traffic going to HTTP and HTTPS and replacing the IP address with the web server. Rule below;

The problem has come into place with more than one domain controller...

Adding another entry in the in the destionation address list throws the following error when commiting;

"Mismatch of destionation address translation range between original and translated address"

I understand it is trying to tell me I can only translate one-to-one when using destination NAT, but I'm wondering why? Could I just have 4 NAT rules for 4 domain controllers all doing the same thing? Or is this not best practice? Is there another way I could configure these devices for the desired effect?

Thanks very much in advance.

Re: Many-to-One Destination NAT

reaper — Fri, 20 May 2016 11:32:34 GMT

NAT will try to apply your translation to a subnet, so a /32 will simply address 1 single host, but adding a secondary ip in there would logically be done by setting the subnet to /30 and translating to a /30 range. 2 or more independent (non-consecutive within the same subnet) destination NAT hosts would require a policy per host (so 4 policies, each containing a single destination subnet of /32, in your example)

Re: Many-to-One Destination NAT

Gurminder — Fri, 20 May 2016 14:16:20 GMT

Thanks for your response.

I have now configured multiple NAT rules for the domain controllers.