This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SNAT not working, getting NAT 0

Anthony Anderson over 4 years ago

Help please,

I have internal server 192.168.99.168 SNAT to x.x.x.168

I have internal server 192.168.99.169 SNAT to x.x.x.169

I have both x.x.x.168 and x.x.x.169 setup as aliases on WAN1

Here is the SNAT rule and its setup identically for the .169

When they try to send email this is the packet capture showing NAT rule 0 is being applied and it's NOT leaving the device as evidenced by no outgoing port. You also see the DNAT is working.

Any ideas? Please help

This thread was automatically locked due to age.

0 rfcat_vk over 4 years ago

Hi,

basically you have your internal addresses being advertised on the internet, the internal addresses are not routable on the internet.

How many internet addresses has your ISP provided you with?

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Anthony Anderson over 4 years ago in reply to rfcat_vk

Wait, anything from 192.168.99.168 is translated to a public address x.x.x.168 and then ejected out WAN1 as public address.

I have a /27 x.x.x.161-x.x.x.190 and I have the .168 and .169 assigned as aliases on the WAN1 port.

I have another client with the exact same configured SNAT rule and it works.
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 4 years ago

Hello Anthony,

Thank you for contacting the Sophos Community!

Please check your route precedence https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en us/webhelp/onlinehelp/nsg/sfos/concepts/RoutingSDWANPolicyRouting.html?hl=sd%2Cwan

(Static, sdwan_policyroute > VPN)

Regards,
Cancel
Vote Up 0 Vote Down

Cancel
0 Anthony Anderson over 4 years ago in reply to emmosophos

Emmo,

Thanks alot for that. I did a show route precedence and I see

console> system route_precedence show
Default routing Precedence:
1. SD-WAN policy routes
2. VPN routes
3. Static routes

We do have a SD-WAN policy in place to load balance Https as well. The thing is you can see from my packet capture that the incoming connection initiated the connection on port 37544 and the 192.168.99.168 server responds to it but it doesn't have an Out Interface listed so the packet doesn't even leave the XG. Riddle me that.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 4 years ago

Is WAN1 = Port1?
Cancel
Vote Up 0 Vote Down

Cancel
0 Anthony Anderson over 4 years ago in reply to LuCar Toni

No, Port 1 is LAN Port2 is WAN1
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 4 years ago in reply to Anthony Anderson

I am not able to understand, how this work in the first place. The NAT is not hitting, therefor the Client should use his internal IP outgoing. The ISP should drop this, but thats not true. Instead the communication is happening.

Does your NAT work, if you reduce the Interface criteria to ANY and only work with the Source IP?
Cancel
Vote Up 0 Vote Down

Cancel
0 Anthony Anderson over 4 years ago in reply to LuCar Toni

Lucar,

You assisted me in https://community.sophos.com/xg-firewall/f/discussions/122835/xg18-snat-to-wan-alias . I got that Source NAT working and the site has used that source NAT rule over 4,000,000 times. Customer also tested and confirmed communication from the server is seen as the desired alias.

Back to this discussion: I configured the NAT rule identically but its not even forwarding traffic out any interface now. Also, I don't need the internal 192.168.99.168 server to respond using x.x.x.168, I need all of its external traffic(webmail) to be seen at all times as coming from x.x.x.168.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 4 years ago in reply to Anthony Anderson

NAT is not forwarding anything. NAT is translating traffic.

Routing stack is responsible for using the correct interface.

Even if there is no NAT at all, XG will forward the traffic to the interface.
Cancel
Vote Up 0 Vote Down

Cancel
0 Anthony Anderson over 4 years ago in reply to LuCar Toni

Ok, so take the packet translate the source IP from 192.168.99.168 to x.x.x.168 and send it out the WAN1 port. Does it not change the Source IP in the IP header when it does this before sending it to the WAN1 gateway?
Cancel
Vote Up 0 Vote Down

Cancel