Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

NAT pool

My first post here -- apologies if this has been dealt with in the past.

I have seen some related discussion on this in the forum but does not seem to answer what I am trying to do:

On an SG appliance running UTM 9.4, I want to use 2 of our external IPs for masquerade (out of a block of /29 that we have).

As an example, to NAT 192.168.1.0/24 to a pool of 2 IPs xxx.149.196.157 and .158,  in cisco IOS I would do

access-list 1 permit 192.168.1.0 0.0.0.255  # define list 1 as the internal address block of /24

ip nat pool pool1 184.149.196.157 184.149.196.158 netmask 255.255.255.248  #  define pool1 as the 2 address pool for NAT

ip nat inside source list 1 pool nat-pool overload   # do balanced NAT-ing using the two publlc addresses in pool1

How to achieve this in UTM 9?

Thanks



This thread was automatically locked due to age.
Parents
  • Hey S.

    I think you might find this useful. It wouldn't be balanced, though. Balancing is only achieved by multipath rules, and those only allow interfaces, not additional addresses.

    Regards - Giovani

  • Thanks for the link. Sorry for my confused use of the word "balancing". We only have one uplink (ISP) so no balancing needed.

    What I was trying is to use more than one external IP for "masquerading". What could be called "dynamic NAT with overload" which translates many internal addresses to a few external addresses with PAT done only if a dynamic 1:1 mapping is is not possible.

    In iptables terms I want an SNAT with multiple --to-source addresses, but it seems UTM's UI does not allow it.

  • AFAIK it won't allow multiple addresses on a SNAT rule, so I guess it's not possible. Maybe someone else might know a way. 

    Regards - Giovani

Reply Children
No Data