Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 2 replies
  • Subscribers 27 subscribers
  • Views 3895 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Appropriate policies/rules for internal to internal via nat'd ip

Dameon Kirchhefer

So here's the situation...

We moved from the UTM 9 to the XG firewall recently and have had issues in the way some of our rules/policies worked.

For SnGs, I'll use the 10 network for internal, and the 128 network for internet.

Core switch = 10.0.0.1       Firewall = 10.0.0.2      Public IP Network, GW, Subnet = 128.0.0.128, 128.0.0.129, 255.255.255.240

I'll do my best to illustrate the layout below.  We have a computer (10.0.0.50) on the internal LAN that has some services.  We have an SNAT /w Masquerading and a DNAT business rule that states 10.0.0.50 can send traffic as 128.0.0.141 and recieves internet traffic sent to 128.0.0.141.  This rule works with no issues.

Computer 2, with IP address 10.0.0.51 can talk to 10.0.0.50 and 50 to 51 with no issues.  10.0.0.51 can NOT talk to 128.0.0.141 at all.

 

How do we allow our internal machines to speak to 128.0.0.141?  We've tried SNAT, DNAT, FullNAT... What are we doing wrong?



This thread was automatically locked due to age.
Parents
  • +1

    Hey  

    In this situation, you would need to configure a hairpin NAT. You mention that you've tried a full-NAT already, but how was this rule created? 

    Create a Business Application Rule - DNAT/Full NAT/Load Balancing:

    • Source: LAN Zone - Any
    • Destination & Service: Public IP of the server (128.0.0.141)
    • Enable Rewrite Source Address (Masquerading)
      • Use outbound address - configure this as the LAN gateway IP address,

    If your still having issues, let me know and I can investigate your configuration further.

    Regards,

Reply
  • +1

    Hey  

    In this situation, you would need to configure a hairpin NAT. You mention that you've tried a full-NAT already, but how was this rule created? 

    Create a Business Application Rule - DNAT/Full NAT/Load Balancing:

    • Source: LAN Zone - Any
    • Destination & Service: Public IP of the server (128.0.0.141)
    • Enable Rewrite Source Address (Masquerading)
      • Use outbound address - configure this as the LAN gateway IP address,

    If your still having issues, let me know and I can investigate your configuration further.

    Regards,

Children