NAT fron Internal to DMZ

[mutsu31]

Hi all...

Can firewall-1 do NAT from internal address to DMZ address ?
If yes, how is the configuration ?

Thanks.

 

[ChrisAC]

Create an object with the private DMZ address and then under the NAT tab put the global address in as a 'static' translation. This will create an automatic NAT rule that can be checked on the NAT tab of the rule base.

Chris.

**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[mutsu31]

Thanks iproute,

But what i meant is to NAT Internal network address to DMZ Network, so if the DMZ network want to access the internal address, it will have to use the translated Internal address.
Can this be done ?

 

[ChrisAC]

You shouldn't really allow anything in the DMZ to access the internal network. However, if you do want to then just create the appropriate access rules in the rule base. You don't have to NAT the traffic in that situation.

If your internal network is hiding behind a PAT address then you can't create an access rule to allow connections to be initiated to that network. If all the network is hiding behind one address then which internal machine would the connection be to? You could only allow an initial connection to something that has a static NAT.

Chris.


**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************