NAT Sanity Check

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

NAT Sanity Check

Hi

 

Can I sanity check a NAT rule please. We have a small satellite office with a PA as the firewall. We only have /30 subnet so one IP for the router and one for the IP of the external NIC on the PA.  

 

We need to have a connection for a service to a telephone system that comes from external to the telephone. So because of the IP limitation need to NAT behind the external interface.  I've created an internal object for the IP address of the telephone, an object for the external IP of the FW NIC and a NAT rule. The zones are just LAN and WAN.

 

The NAT rule is as follows:

 

On the Original Packet tab

the Zone is Internal for the Source

On the Destination Zone is the WAN

Source address is the internal object IP address for the telephone

 

On the Translated Packet Tab

Translation Type is Static IP in Source address Translation

Translated address is the IP of the external NIC of the FW

Bi-directional is ticked Yes.


That should work and achieve what is required??

 

Thanks for any help, it is appreciated.

1 REPLY 1

Hi @newcollegedurham ,

 

I am guessing you have also "default" source hide-NAT rule at the bottom, which will translate all internal networks to internet, is that correct? If yes, I am not sure if using the same public IP for static NAT and for dynamic ip and port (DIPP) will not cause commit error. I could be wrong, but I am trying to imagine how FW will handle the port mapping for each session.

 

Creating static source NAT with bi-directional will NAT will create destination NAT rule matching any destination port. I would suggest you to consider to create the inbound NAT rule manually instead of using the bi-directional feature.

- First benefit it will be visible in the GUI, so it will be easier to be spot

- Second benefit is that you can specify port or port range, which leaves you options to use the other available ports for future needs. This could be little tricky as you want to NAT telephone system, which will require some large port ranges.

  • 286 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!