07-14-2020 09:43 AM
The firewalls can be apart of the same Device Group and Template Stack.
For inbound NAT policies, the set the source interface to the untrust NIC and the destination address to "any". The DNAT address must be set to dynamic-destination-translation.
The example below has 2 inbound DNAT policies (jump-server and web-server) and 1 outbound SNAT (for outbound internet). Ethernet1/1 is untrust and Ethernet1/2 is trust.
(Optional & only if using Azure's public load balancer): If you enable "Floating IP" on the load balancing rule, the original packet's destination address can be set to the load balancer's public IP. This is useful if you have multiple applications that share the same port.
