Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Configure NAT with multiple ports

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Configure NAT with multiple ports

L3 Networker

Hello ocmmunity,

 

Do you know if it is possible to do this in the firewall ?

Name:  NAT 1
Source Zone: INTERNET
Destination Zone: INTERNET
Source Address: IP_Public
Destination Address: 1.1.1.1
Service: icmp, tcp/5551, tcp/22, tcp/4443, udp/500, udp/4500
Destination Translation:Device (10.140.2.1)

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

I know that Destination nat is one - to - one,  so in this case

 

1. I will need to perform one NAT rule to each service. Correct ? In this case, one to allow port 5551, other to allow port 22, etc.

2. Is poosible that all these rules have the same Destination Address (Destination Address: 1.1.1.1) and same Destination traslation (Destination Translation:Device (10.140.2.1).

 

3. I have 3 security rules where I'm allowing  these services.

3.1. Rule 1  allow the app "icmp",

3.2  Rule 2  allow ports 5551, 22 & 4443,

3.3  Rule 3  allow ports udp500 / udp4500

 

++++++++++++++++++++

 

I appreciate your feedback.

 

Best Regards

Andres

Best Regards
1 accepted solution

Accepted Solutions

You can combine all the UDP and TCP ports in one single NAT policy, you only need to add a port to the destination translation if you want to change the destination, eg. change incoming port 4443 to 443 on the webserver, but if the destination port does not need to change you can leave the translation port field empty

many services nat.png

 

 

the only 'problem' is that ICMP can only be NATed through an 'any' policy so you'll either need to skip ICMP or create an 'any' policy and then filter based on security policies

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

View solution in original post

3 REPLIES 3

L6 Presenter

If you want to NAT ICMP (or any protocol other than UDP or TCP) you need to use any as service. So I suggest 1 NAT rule with any as a service and do your filtering with firewall rules (which is a good idea in any case).

 

 

You can combine all the UDP and TCP ports in one single NAT policy, you only need to add a port to the destination translation if you want to change the destination, eg. change incoming port 4443 to 443 on the webserver, but if the destination port does not need to change you can leave the translation port field empty

many services nat.png

 

 

the only 'problem' is that ICMP can only be NATed through an 'any' policy so you'll either need to skip ICMP or create an 'any' policy and then filter based on security policies

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Cool, I create 5 nat rules and working as expected , but is good to know this option to future implementations.

Thanks a lot for your feedback.

 

Best regards

Andres Padilla

Best Regards
  • 1 accepted solution
  • 6250 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!