At a customer site we must migrate from an Arkoon FAST360 to a SG UTM.
The customer is in Belgium and using a Mobistar internet link
The Mobistar router is using 172.16.0.1 address with the WAN eth of Arkoon/SG using 172.16.0.254 address
Some years ago some NAT rules were setup in the Arkoon to enable remote customer sites, both VPN and public ip, to connect to a web server trough a special Arkoon NAT rule that was dnatting 443 to an internal webserver at 192.168.200.200 (in a DMZ network) and snatting with the address of Mobistar router 172.16.0.1
It was working that way because of the Mobistar router using some unknown NAT as is the entry point for both private network VPN and public address sources.
So we've setup a Full NAT rule on the SG going to replace the Arkoon at the site, but with no success as of today.
Our Full NAT rule is set for the DNAT the same way as the Arkoon and SNAT with a network host defined to the Mobistar address 172.16.0.1
When we were trying to swap the Arkoon for the Sophos SG, the SNAT part of the rule doesn't seem to work, so all of the remote sites were kept out of the web server.
SNAT part solely masquerade destination to the Mobistar address.
Our SG is currently running 9.355 as the Mobistar does not allow SG update at the moment (usually we upgrade to 9.411)
Can it be a 9.355 flaw or was my Full NAT rule not the right SG translation of what is was doing with the Arkoon FAST360 ?
Note : I'm french
Edit : added screens of Arkoon rule
This thread was automatically locked due to age.
