Intra-Zone Source (dynamic) NAT

FaniKhatakaar — Thu, 24 Aug 2017 02:55:18 GMT

Guest network (10.10.10.0/24) is in Outside zone & Internet link (11.11.11.11/24) is also in same zone.
Guests need to browse internet (say google.com)

My question is about intra-zone source NAT/PAT!

Guest, who is the source of the traffic; requires translation to public IP address (say outside interface of the firewall).
Destination of the traffic is internet i.e. public IP address doesnt need any translation.

Such intra-zone source NAT/PAT is possible? If Yes, How?

Original packet:
Source Zone: Outside
Source Network: Guest network private IP address
Destination Zone: Outside
Destination Network: any
Application: web-browsing
service: http
protocol: tcp

Translated packet:
Source Zone: Outside
Source Network: Guest network public IP address / Firewall outside interface / public IP pool etc.
Destination Zone: Outside
Destination Network:any

Re: Intra-Zone Source (dynamic) NAT

reaper — Thu, 24 Aug 2017 07:15:16 GMT

yes this is perfectly possible

the policy would look nearly identical to a 'normal' nat rule since the operation is identical, but since your source user is in the same zone, the source and destination zone will be identical

this in itself is not a problem but for security i'd recommend putting the users in their own zone (this will give you more control over their connections through security policy)

topic Intra-Zone Source (dynamic) NAT in General Topics

Intra-Zone Source (dynamic) NAT

Re: Intra-Zone Source (dynamic) NAT