Is it possible to turn off even layer 4 inspection for a traffic flow?

[Shuttermed]

I had a request to turn off not only layer 7 inspection (which I understand can be done with an application override)

but to turn off all inspection such that the flow only NATs? 

[OtakarKlier]

Hello,

Do you mean only allow traffic by ports?

Please advise,

[Shuttermed]

I mean to allow the traffic to be NATted but don't inspect the traffic at layer 4 say for proper sequencing and other typical layer 4 inspection. It's something I was requested to do and will likely not do. But I want to know if you even wanted to do it could you make a specific traffic like pass through like a router with NAT?

[OtakarKlier]

Hello,

I suppose you could by not adding any of hte security policies to the policy you have that allows the traffic. However I would not recommend it for security reasons.

Hope that helps.

[Remo · Accepted solution]

1. Create an any-any application override policy
2. Create an any-any-allow security policy without adding any profiles
3. Do not add any zone protection profiles to the zones
4. Create your required NAT policy
5. Have fun with your pretty expensive NAT router 😉

[Shuttermed]

Hey - don't rub it in. 

🙂

Thanks.

[Shuttermed]

And after all that - we tested at another time with another machine and got smooth live video via the PAN. 

So it's looking like it could be an issue of non-guaranteed interwebs or local machine or who knows what.

But our infrastructure is way over built so it's not saturation and now not likely the PAN. So no need for

the costly NAT router. Woot.