BUG - logviewer and linked NAT rules

NAT rule table (Linked as well as normal) is traversed from top to bottom and rule is triggered where criteria is matched. Linked NAT rule has the fw rule id in the matching criteria. However, if there is any other rule (for example say blanket Any-Any NAT rule) on top of the Linked NAT that matches the traffic, that will trigger.

For MASQ requirement on outgoing traffic, we are improving NAT with the introduction of NAT wizard, default SNAT MASQ rule and better UI placement. This would make things easier for such use cases.

There is only case where traffic hits firewall rule but associated Linked NAT rule is not triggered, that is - if a DNAT rule is already matched for a traffic initially, Linked SNAT will NOT again be traversed for that traffic post firewall table. And SNAT decision configured in the matched DNAT rule (This can be called full NAT or mixed NAT scenario) will apply for SNAT.

We have published how-to video guide exclusive for NAT enhancements in v18. This covers SNAT, DNAT and PAT with deployment examples; explains migration from v17.x, caveats, additional details and troubleshooting guidance. Here is the how-to video guide link: NAT Configurations in XG firewall v18.

Also, here is the FAQs link that helps understand New decoupled NAT and firewall changes in SFOS v18: https://community.sophos.com/products/xg-firewall/sfos-eap/sfos-v18-early-access-program/f/recommended-reads/116102/understanding-new-decoupled-nat-and-firewall-changes-in-v18

Thank you very much for your support.

Hi PMParth,

thank you for the in-depth explanation, but it does not answer my question about NAT 0. I have an intra-lan firewall rule that does not have a NAT rule, under V17.5 access worked without adding NAT rule. Now I can connect the device but no data is returned eg both Safari and FF return a blank screen indicating a successful connection. A refresh has no affect.

Ian

Another issue.

I have an IPv6 rule which has a linked NAT rule. The firewall rule allows https and http with https decrypt and scanning enabled?

Why does some traffic using the firewall rule go through the associated NAT and other traffic using the same firewall rule go through NAT rule 0?

Ian

Another issue.

I have an IPv6 rule which has a linked NAT rule. The firewall rule allows https and http with https decrypt and scanning enabled?

Why does some traffic using the firewall rule go through the associated NAT and other traffic using the same firewall rule go through NAT rule 0?

Ian

I have had similar problems. I created about 12 rules ALL with connected NAT rules. When tinkering too much with firewall rules for troubleshooting, I noticed that some of my firewall rules were using NAT rule 0. I also had a couple that were using another NAT rule. For example my Netflix rule only allows netflix traffic with its own NAT but then my media players have a dedicated firewall rule for other traffic with its own NAT. Every once in a while, the logs would show firewall rule Netflix and NAT rule media player. I thought linked NAT rules couldn't be used by other firewall rules.

My only solution was to create single LAN to WAN NAT and another NAT or two for special needs like business rules or DNS catch all rules.I have used other firewalls with NAT in every firewall rule and have never run into the problem like this. Something is seriously wrong and I really don't have time to troubleshoot at the moment.

Regards 

Hi Billybob,

thank you for the confirmation. I also noted that the web page connects were faster with linked rules rather than generic rules, that is why I returned to using linked NAT.

Ian