Hello, 1. I have three zones: Public, DMZ, Private Public interface: bound to 164.67.80.124/26 Private interface: bound to 192.168.1.1/24 DMZ interface: bound to 192.168.2.1/24 2. I use bi-directional NAT to expose a few of the DMZ machines via their own public IP addresses: 164.67.80.77 <-> 192.168.2.77 164.67.80.78 <-> 192.168.2.78 164.67.80.79 <-> 192.168.2.79 Example: Source zone: DMZ Destination zone: Public Destination Interface: any Source Address: 192.168.2.77 Destination Address: any Service: any Source Translation: static-ip, 164.67.80.77, bi-directional: yes Destination Translation: none 3. I add security policies to allow the DMZ machines to access the internet and be accessed from the internet. 4. None of my interfaces are explicitly bound to 164.67.80.77, 78, or 79. This works due to something called "Proxy ARP" on the public interface (as explained to me in these discussion forums). 5. I add a "Source NAT" policy with the intention of providing internet access to the Private zone: Source zone: Private Destination zone: Public Destination Interface: any Source Address: any Destination Address: any Service: any Source Translation: dynamic-ip-and-port, 164.67.80.124 Destination Translation: none 6. I don't yet add a security policy to allow Private machines to the Public zone. 7. After step 5, the communication between the DMZ and Public stops. Internet cannot access the DMZ machines via the public IP addresses and the DMZ cannot access the internet. Question: Why does the DMZ stop working when I perform step 5? Thank you, Chris
... View more
