This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Need Expert help to use multiple NAT

Hello

Plz brother i need help in this complex architect, i don't know exactly what's the best scenario i must deploy to make this working

for more details plz see the picture :

I want (TopUser) having for exemple 172.16.10.1 get internet by Fibre1 ligne internet, and (NormalUser) with the ip adresse 172.16.11.2 get internet by ADSL ligne.

As you know Peplink can not understand trafic by identity, i can only configure the peplink to use ip adresse or vlans

The problem is how peplink can know that the 172.16.10.1/24 is for TopUser in order to let them get internet by Fibre1

the possible solution i think is to create a special NAT for the Rule policy of the TopUser,meaning TopUser must use the NAT 192.168.1.10/24, and i'll go to peplink and creat an outbound policy to let this 192.168.1.10/24 get internet by fibre1

If this scenario is true, then can i create an virtual-IP on the sophos WAN interface, (192.168.1.10/24) in order to use it as a NAT like we say (i have 1 physical WAN inerface)

If there is another correct and working scénario plz give me it

Plz help me as soon as possible i'm blocked

Thanks a lot in advance

This thread was automatically locked due to age.

0 lferrara over 7 years ago
Hamza,

in Gateway mode, source IP are routed by XG and then the Peplink does not know VLAN addresses. You only have 2 methods:

Remove the peplink and manage the load balancing using XG directly

Deploy XG as bridge (but in the current version, some issue on VLAN-Bridge mode exist).https://community.sophos.com/products/xg-firewall/f/network-and-routing/89867/sophos-xg-bridge-mode-in-multi-vlan-enviroment

No other real alternatives.
Cancel
Vote Up 0 Vote Down

Cancel
0 hamza zidane over 7 years ago in reply to lferrara

Ok, then what if i'll create a Rule for the TopUser, and create a Sub-interface/virtual-ip on the Physical WAN interface, and finaly use it as NAT like this picture !!
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 7 years ago in reply to hamza zidane

Sorry Hamza,

but I do not understand how that subinterface will be able to connect with Peplink.
Cancel
Vote Up 0 Vote Down

Cancel
0 hamza zidane over 7 years ago in reply to lferrara

Thanks very much for your time and help, ok then what about "NAT OverLaoding" ?

As we know the "NAT OverLaoding" add a Port Number to the "Private IP", then if this is possible, in sophos i'll try to configure it for adding a special port to private ip of the TOPUser(172.16.10.1), like this 172.16.10.1:123,

and i'll configure peplink to outbound trafic coming from the ip adresse 192.168.1.2 with th port 123 to get internet by fibre1 ligne

theoretically i think it's correct, but is it possible to manipulate the NAT Overlaoding in Sophos ? i think it was possible in UTM9
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 7 years ago in reply to hamza zidane

Why are you using the peplink? Seems like a waste of resources and an added complication to your network. You do not appear to be performing load balancing with it?

Also it is another none secure device outside of your firewall.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 7 years ago in reply to hamza zidane

Hamza,

this is something not possible. I guess you have installed XG to get proper protection, web/ips/app filtering.

I would remove the load balancer and use only XG, unless you do not need special load balancing capacity like link-proof.

Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 hamza zidane over 7 years ago in reply to lferrara

Ok thanks very much for your help, i appreciate :)
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 7 years ago in reply to hamza zidane

Hamza,

please let us know what configuration you choose at the end so the thread can be marked as completed and other users will benefit of it.

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 hamza zidane over 7 years ago in reply to lferrara

with all my pleasure brother but it deponds to my boss, i'm still waiting for the conformation, any update i'll get i'll share it
Cancel
Vote Up 0 Vote Down

Cancel