1:1 NAT configuration

[khomer]

Hello,

I'm having issues with 1:1 NAT set up. Using a pair of PA-5220s in Active/Passive set up. I need to set up temporary access to some devices behind the firewall. I have a block of IPs I can use. Do I need to set an IP from that block on an interface? The block I have is being routed to the primary IP of the firewall right now. What I'm trying to accomplish is:

Public IP-1> 10.9.20.143 (with 5 ports)

Public IP-2> 10.9.20.144 (with same 5 ports)

public IP-3> 10.9.20.155 (only one port)

Then would I need a separate rule for each NAT policy?

[SutareMayur]

@khomer,

As per my understanding, you want to allow access to the devices using public IPs on specific ports which are behind the firewall. So yes whatever public IPs you want to use under Destination NAT, those IPs should be routable through the circuit terminated on the firewall where the request will come. Yes, most of the time it would be from the block which is configured on the interface.

Below NAT use cases given, you need to configure Destination static NAT. You need to have dedicated security policy and NAT for each public IP with specific ports. You can have common security policy for the public IPs which need to be allow on the same ports and the zones. But for NAT yes, there should be separate  NAT-Policy for each translation.

Also I would like to add here, as you’re giving access to your devices over public network, better make it available to specific source IP addresses only if possible.

Hope it helps!

[reaper]

Those IP addresses do not need to be assigned to an interface as the firewall is capable of performing proxy-ARP for any destination IP in a NAT rule that performs destination NAT

As a best practice you should make sure the "destination interface" is set in the NAT rule to the external interface, so the firewall knows to only broadcast proxy-ARP on that interface