- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Can I sanity check a NAT rule please. We have a small satellite office with a PA as the firewall. We only have /30 subnet so one IP for the router and one for the IP of the external NIC on the PA.
We need to have a connection for a service to a telephone system that comes from external to the telephone. So because of the IP limitation need to NAT behind the external interface. I've created an internal object for the IP address of the telephone, an object for the external IP of the FW NIC and a NAT rule. The zones are just LAN and WAN.
The NAT rule is as follows:
On the Original Packet tab
the Zone is Internal for the Source
On the Destination Zone is the WAN
Source address is the internal object IP address for the telephone
On the Translated Packet Tab
Translation Type is Static IP in Source address Translation
Translated address is the IP of the external NIC of the FW
Bi-directional is ticked Yes.
That should work and achieve what is required??
Thanks for any help, it is appreciated.
Hi @newcollegedurham ,
I am guessing you have also "default" source hide-NAT rule at the bottom, which will translate all internal networks to internet, is that correct? If yes, I am not sure if using the same public IP for static NAT and for dynamic ip and port (DIPP) will not cause commit error. I could be wrong, but I am trying to imagine how FW will handle the port mapping for each session.
Creating static source NAT with bi-directional will NAT will create destination NAT rule matching any destination port. I would suggest you to consider to create the inbound NAT rule manually instead of using the bi-directional feature.
- First benefit it will be visible in the GUI, so it will be easier to be spot
- Second benefit is that you can specify port or port range, which leaves you options to use the other available ports for future needs. This could be little tricky as you want to NAT telephone system, which will require some large port ranges.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!