Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can I replace all masquerade rules with Source NAT (SNAT)?

Hello, I would like to replace all my masquerade rules with Source NAT (SNAT). This has already been done for several internal subnets and appears to work fine. We do not use dynamic external IP addressing so I believe there is no need for masquerade. Additionally, I've read that masquerading requires more processing power than SNAT.

I personally prefer an organized group of SNAT/DNAT/FullNAT rules. It seems also that the UTM's interface for masquerade rules is somewhat lacking compared to the NAT rules (for example, you cannot hover over some objects to get their address which is inconvenient).

Please let me know if there is any reason that ANY masquerade rules MUST exist. I do not see a reason, assuming that I recreate every rule as an SNAT. I understand that masquerade acts in a "catch-all" default scenario ... but I believe if I properly understand the network that all scenarios could be explicitly defined in SNAT.

Am I off base here?

Thank you for your reply.



This thread was automatically locked due to age.
Parents
  • I would expect masquerading to be more efficient because there's no step of checking the Service or Destination, but any difference in the amount of processing power would have to be so small that it wouldn't be noticed.  As many others have said here before me, masquerading is a part of the culture around the UTM, so using it where possible would make it easier to get help with a problem here or from Sophos Support.  Other than that, the effect is indeed the same.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • I would expect masquerading to be more efficient because there's no step of checking the Service or Destination, but any difference in the amount of processing power would have to be so small that it wouldn't be noticed.  As many others have said here before me, masquerading is a part of the culture around the UTM, so using it where possible would make it easier to get help with a problem here or from Sophos Support.  Other than that, the effect is indeed the same.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data