Intra-Zone Source (dynamic) NAT

[FaniKhatakaar]

Guest network (10.10.10.0/24) is in Outside zone & Internet link (11.11.11.11/24) is also in same zone.
Guests need to browse internet (say google.com)

My question is about intra-zone source NAT/PAT!

Guest, who is the source of the traffic; requires translation to public IP address (say outside interface of the firewall).
Destination of the traffic is internet i.e. public IP address doesnt need any translation.

Such intra-zone source NAT/PAT is possible? If Yes, How?

Original packet:
Source Zone: Outside
Source Network: Guest network private IP address
Destination Zone: Outside
Destination Network: any
Application: web-browsing
service: http
protocol: tcp

Translated packet:
Source Zone: Outside
Source Network: Guest network public IP address / Firewall outside interface / public IP pool etc.
Destination Zone: Outside
Destination Network:any

[reaper · Accepted solution]

yes this is perfectly possible

the policy would look nearly identical to a 'normal' nat rule since the operation is identical, but since your source user is in the same zone, the source and destination zone will be identical

this in itself is not a problem but for security i'd recommend putting the users in their own zone (this will give you more control over their connections through security policy)