Print Download PDF Send Feedback

Previous

Next

Configuring the NAT Policy

In This Section:

Translating IP Addresses

NAT Rules

Configuring Static and Hide NAT

Advanced NAT Settings

Translating IP Addresses

NAT (Network Address Translation) is a feature of the Firewall Software Blade and replaces IPv4 and IPv6 addresses to add more security. You can enable NAT for all SmartConsole objects to help manage network traffic. NAT protects the identity of a network and does not show internal IP addresses to the Internet. You can also use NAT to supply more IPv4 addresses for the network.

The Firewall can change both the source and destination IP addresses in a packet. For example, when an internal computer sends a packet to an external computer, the Firewall translates the source IP address to a new one. The packet comes back from the external computer; the Firewall translates the new IP address back to the original IP address. The packet from the external computer goes to the correct internal computer.

SmartConsole gives you the flexibility to make necessary configurations for your network:

How Security Gateways Translate Traffic

A Security Gateway can use these procedures to translate IP addresses in your network:

Using Hide NAT

For each SmartConsole object, you can configure the IP address that is used to translate addresses for Hide NAT mode:

Hide NAT uses dynamically assigned port numbers to identify the original IP addresses. There are two pools of port numbers: 600 to 1023, and 10,000 to 60,000. Port numbers are usually assigned from the second pool. The first pool is used for these services:

If the connection uses one of these services, and the source port number is below 1024, then a port number is assigned from the first pool.

You cannot use Hide NAT for these configurations:

Sample NAT Deployments

Static NAT

Firewalls that do Static NAT, translate each internal IP address to a different external IP address.

Static_NAT R80.10

Item

Description

3

External computers and servers in the Internet

2

Security Gateway - Firewall is configured with Static NAT

1

Internal computers

Sample Static NAT Workflow

An external computer in the Internet sends a packet to 192.0.2.5. The Firewall translates the IP address to 10.10.0.26 and sends the packet to internal computer A. Internal computer A sends back a packet to the external computer. The Firewall intercepts the packet and translates the source IP address to 192.0.2.5.

Internal computer B (10.10.0.37) sends a packet to an external computer. The Firewall intercepts the packet translates the source IP address to 192.0.2.16.

Internet sends packet to 192.0.2.5

Firewall translates this address to 10.10.0.26

Internal computer A receives packet

 

 

 

 

 

Internal computer A (10.10.0.26) sends packet to Internet

Firewall translates this address to 192.0.2.5

Internet receives packet from 192.0.2.5

 

 

 

 

 

Internal computer B (10.10.0.37) sends packet to Internet

Firewall translates this address to 192.0.2.16

Internet receives packet from 192.0.2.16

Hide NAT

Firewalls that do Hide NAT use different port numbers to translate internal IP address to one external IP address. External computers cannot start a connection to an internal computer.

Hide_NAT

Item

Description

1

Internal computers

2

Security Gateway - Firewall is configured with Hide NAT

3

External computers and servers in the Internet

Sample Hide NAT Workflow

Internal computer A (10.10.0.26) sends a packet to an external computer. The Firewall intercepts the packet and translates the source IP address to 192.0.2.1 port 11000. The external computer sends back a packet to 192.0.2.1 port 11000. The Firewall translates the packet to 10.10.0.26 and sends it to internal computer A.

Internal computer A (10.10.0.26) sends packet to Internet

Firewall translates this address to 192.0.2.1 port 11000

Internet receives packet from 192.0.2.1
port 11000

 

 

 

 

 

Internet sends back packet to 192.0.2.1
port 11000

Firewall translates this address to 10.10.0.26

Internal computer A receives packet