- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
03-21-2017 04:35 PM
Hello ocmmunity,
Do you know if it is possible to do this in the firewall ?
Name: NAT 1
Source Zone: INTERNET
Destination Zone: INTERNET
Source Address: IP_Public
Destination Address: 1.1.1.1
Service: icmp, tcp/5551, tcp/22, tcp/4443, udp/500, udp/4500
Destination Translation:Device (10.140.2.1)
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
I know that Destination nat is one - to - one, so in this case
1. I will need to perform one NAT rule to each service. Correct ? In this case, one to allow port 5551, other to allow port 22, etc.
2. Is poosible that all these rules have the same Destination Address (Destination Address: 1.1.1.1) and same Destination traslation (Destination Translation:Device (10.140.2.1).
3. I have 3 security rules where I'm allowing these services.
3.1. Rule 1 allow the app "icmp",
3.2 Rule 2 allow ports 5551, 22 & 4443,
3.3 Rule 3 allow ports udp500 / udp4500
++++++++++++++++++++
I appreciate your feedback.
Best Regards
Andres
03-22-2017 02:11 AM - edited 03-22-2017 02:14 AM
You can combine all the UDP and TCP ports in one single NAT policy, you only need to add a port to the destination translation if you want to change the destination, eg. change incoming port 4443 to 443 on the webserver, but if the destination port does not need to change you can leave the translation port field empty
the only 'problem' is that ICMP can only be NATed through an 'any' policy so you'll either need to skip ICMP or create an 'any' policy and then filter based on security policies
03-22-2017 12:57 AM
If you want to NAT ICMP (or any protocol other than UDP or TCP) you need to use any as service. So I suggest 1 NAT rule with any as a service and do your filtering with firewall rules (which is a good idea in any case).
03-22-2017 02:11 AM - edited 03-22-2017 02:14 AM
You can combine all the UDP and TCP ports in one single NAT policy, you only need to add a port to the destination translation if you want to change the destination, eg. change incoming port 4443 to 443 on the webserver, but if the destination port does not need to change you can leave the translation port field empty
the only 'problem' is that ICMP can only be NATed through an 'any' policy so you'll either need to skip ICMP or create an 'any' policy and then filter based on security policies
03-23-2017 11:06 AM
Cool, I create 5 nat rules and working as expected , but is good to know this option to future implementations.
Thanks a lot for your feedback.
Best regards
Andres Padilla
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!