Double NAT?

[desperado618]

I have a customer that has an IP Pool NAT assigned to all incomming VPN connections. He would like all VPN connections destined for a certain IP address with the source of Telnet to be hide natted. Can some please explain if this is possible?

 

[ansellrk]

yes it is possible. you need to create a manual NAT rule which says Source (NAT range) Destination (Server) Service (Telnet) to Source (Hidden Range) Destination (Server) Service (Telnet).

Hope that makes sense!

 

[desperado618]

I tried that initially and it did not work. I was told it has something to do with the was IP Pool NATS work. As I understand it, once a match is made for a NAT rule ( in this case the IP Pool NAT in the FW object), the rest of the NAT rules are not read (which would be where the manual nat rule would reside).
This works much like the access rules work. Once a match is found, the kernel does not continue parsing the rest of the rulebase.