Alto MS Series User Manual download pdf (Page 47)

Getting Started Guide 43

Create the Security Perimeter Configure NAT Policies

Configure NAT Policies

Based on the example topology we used to create the interfaces and zones, there are three NAT policies we need

to create as follows:

 To enable the clients on the internal network to access resources on the Internet, the internal 192.168.1.0

addresses will need to be translated to publicly routable addresses. In this case, we will configure source

NAT, using the egress interface address, 203.0.113.100, as the source address in all packets that leave the

firewall from the internal zone. See Translate Internal Client IP Addresses to your Public IP Address for

instructions.

 To enable clients on the internal network to access the public web server in the DMZ zone, we will need to

configure a NAT rule that redirects the packet from the external network, where the original routing table

lookup will determine it should go based on the destination address of 203.0.113.11 within the packet, to

the actual address of the web server on the DMZ network of 10.1.1.11. To do this you must create a NAT

rule from the trust zone (where the source address in the packet is) to the untrust zone (where the original

destination address is) to translate the destination address to an address in the DMZ zone. This type of

destination NAT is called U-Turn NAT. See

Enable Clients on the Internal Network to Access your Public Servers

for instructions.

 To enable the web server—which has both a private IP address on the DMZ network and a public-facing

address for access by external users—to both send and receive requests, the firewall must translate the

incoming packets from the public IP address to the private IP address and the outgoing packets from the

private IP address to the public IP address. On the firewall, you can accomplish this with a single

bi-directional static source NAT policy. See

Enable Bi-Directional Address Translation for your Public-Facing

Servers

1 2 ... 42 43 44 45 46 47 48 49 50 51 52 ... 107 108

No comments

Alto MS Series User Manual Page 47