05-03-2021 10:17 AM - last edited on 06-03-2021 08:08 PM by icharkashy
We have a simple basic setup:
WAN1/1 Untrust IP 220.127.116.11/29
LAN1/2 Trust IP 10.9.8.1/16
We NAT our WAN interface out to a different IP in the same network. 18.104.22.168
NAT POL Trust to Untrust Int1/1 Any Any to 22.214.171.124
Security Pol is Any Any
I ping 126.96.36.199 from the LAN1/1 and it NATs out correctly with the .90 address
Devices behind the firewall are not getting NAT'd out, I have pcap that shows this. The pcap does not show the NAT'd IP just the trust traffic from the device to the LAN1/1 on both outbound and inbound traffic.
I can also ping the ISP GW from the downstream devices so I can get traffic beyond the FW but nothing beyond that.
05-04-2021 11:28 AM
ame: ethernet1/1, ID: 16
Operation mode: layer3
Virtual router VR-1
Interface MTU 1500
Interface IP address: 188.8.131.52/29
Interface management profile: no
Service configured: IKE
Zone: Untrust-ISP1, virtual system: vsys1
Adjust TCP MSS: no
05-04-2021 01:38 PM
everything looks ok...
if you start a ping out to the internet, can you check if the session ID of your outgoing ping to see which rules it hits etc:
show session all filter destination 184.108.40.206 application ping
show session id xxx
05-05-2021 04:29 AM
I can ping the internet from the Trust interface but nothing behind it. My pcap shows ping from the trust interface NATs out correctly but the ping from a the devices behind the FW do not NAT at all. Ping source 10.61.1.1 to host 220.127.116.11 success, Ping source 10.61.1.2 host 18.104.22.168 fails....aged out. Basically no NAT from devices behind the Trust interface.
05-05-2021 06:17 AM
Strange I updated the OS 9.1.4 to 9.1.5 rebooted and now it is working
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!