topic Firewall not advertising the public IP in General Topics

Firewall not advertising the public IP

Farzana — Wed, 23 Aug 2017 06:47:46 GMT

Hello,

We want to allow traffic from outside to come inside our server however cannot see any traffic unless loopback is used. This server is behind DMZ. We can solve the public IP address of the server when we go to www.whatismyip.com

Traceroute stops at 13th hop before we added loopback for the public IP.

We are using Source NAT like below:

In the Original Packet tab: Source Zone=DMZ, Destination Zone=WAN, Destination Interface=any, Service=any, Source Address=Local IP address of DMZ, Destination Address=any.

In the Translated Packet tab: Under Source Address Translation, Translation Type=Static IP, Translated Address=Public IP address of server, check Bi-directional.

We are using security policy as below:

Select Source Zone=Outside/WAN, Source Address=any, Destination Zone=DMZ, Destination Address=Public Address of the server, Application=ssl, Service=application-default, URL category=any, Action=allow.

Is there a solution wherein the NATing works without adding loopback or is it that loopbacks are mandatory for NATing?

Thanks in advance.

Re: Firewall not advertising the public IP

reaper — Wed, 23 Aug 2017 09:03:22 GMT

Is the public IP address you used in the translation part of the subnet that's configured on the WAN interface ?

If you add the subnet to the external interface, this will simplify proxy-arp broadcasts. Else, a loopback interface in the wan zone will do the trick

Re: Firewall not advertising the public IP

Farzana — Wed, 23 Aug 2017 09:15:25 GMT

Hi Reaper,

No, the public IP address is not part of the WAN interface subnet. We have already added the loopback in the WAN zone and it works. Ques is: is there a solution wherein the NATing works without adding loopback or is it that loopbacks are mandatory for NATing?

Re: Firewall not advertising the public IP

reaper — Wed, 23 Aug 2017 09:19:38 GMT

the firewall needs to determine to which interface the IP address belongs for it to be able to send out proxy arp (else it could flood out all interfaces). therefore you should add the subnet to the external interface (or use individual loopbacks)

if you don't want to add the subnet or use loopbacks, you can create static ARP entries on the upstream router that point to your firewall interface for the desired IPs also

Re: Firewall not advertising the public IP

TranceforLife — Wed, 23 Aug 2017 09:24:31 GMT

I just feel expertise in your responses @reaper