Firewall not advertising the public IP

[Farzana]

Hello,

We want to allow traffic from outside to come inside our server however cannot see any traffic unless loopback is used. This server is behind DMZ. We can solve the public IP address of the server when we go to www.whatismyip.com

Traceroute stops at 13th hop before we added loopback for the public IP.

We are using Source NAT like below:

In the Original Packet tab: Source Zone=DMZ, Destination Zone=WAN, Destination Interface=any, Service=any, Source Address=Local IP address of DMZ, Destination Address=any.

In the Translated Packet tab: Under Source Address Translation, Translation Type=Static IP, Translated Address=Public IP address of server, check Bi-directional.

We are using security policy as below:

Select Source Zone=Outside/WAN, Source Address=any, Destination Zone=DMZ, Destination Address=Public Address of the server, Application=ssl, Service=application-default, URL category=any, Action=allow.

Is there a solution wherein the NATing works without adding loopback or is it that loopbacks are mandatory for NATing?

Thanks in advance.

[reaper]

Is the public IP address you used in the translation part of the subnet that's configured on the WAN interface ?

If you add the subnet to the external interface, this will simplify proxy-arp broadcasts.  Else, a loopback interface in the wan zone will do the trick

[Farzana]

Hi Reaper,

No, the public IP address is not part of the WAN interface subnet. We have already added the loopback in the WAN zone and it works. Ques is: is there a solution wherein the NATing works without adding loopback or is it that loopbacks are mandatory for NATing?

[reaper · Accepted solution]

the firewall needs to determine to which interface the IP address belongs for it to be able to send out proxy arp (else it could flood out all interfaces). therefore you should add the subnet to the external interface (or use individual loopbacks)

if you don't want to add the subnet or use loopbacks, you can create static ARP entries on the upstream router that point to your firewall interface for the desired IPs also

[TranceforLife]

I just feel expertise in your responses @reaper