cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Who Me Too'd this solution

L1 Bithead

The firewalls can be apart of the same Device Group and Template Stack. 

 

For inbound NAT policies, the set the source interface to the untrust NIC and the destination address to "any".  The DNAT address must be set to dynamic-destination-translation.  

 

The example below has 2 inbound DNAT policies (jump-server and web-server) and 1 outbound SNAT (for outbound internet).  Ethernet1/1 is untrust and Ethernet1/2 is trust. 

 

Screen Shot 2020-07-14 at 12.27.39 PM.png

 

(Optional & only if using Azure's public load balancer):  If you enable "Floating IP" on the load balancing rule, the original packet's destination address can be set to the load balancer's public IP.  This is useful if you have multiple applications that share the same port.  

 

Screen Shot 2020-07-14 at 12.40.38 PM.png

 

 

 

 

 

 

 

 

 

View solution in original post

Who Me Too'd this solution