NAT packets

[Donachie]

I have been asked to NAT some traffic leaving our network behind the vrrp address of our pair. No problem there.

My question relates to the replies back. All connections will be initiated on our side - none will ever be initiated from the remote side ( an HSRP address of a pair of Ciscos).

My question is this:

with the reply packets to my vrrp address - the firewall forwards them to the requesting client, from the state table. What will the source ip of the packets be that are sent to the internal clients be? The VRRP address or the actual IP address?

Thanks.

 

[ChrisAC]

The source address will be the end system that you are connecting to, not the firewall, unless of course you are connecting TO the firewall and not just THROUGH it.

If you look at your NAT rules tab you will see where the source and destination addresses are altered. So for example if you connect to say

http://www.tek-tips.com

on 216.45.19.33 then the original source will be the IP address of the host on your LAN and the destination will be 216.45.19.33. When the packets hit your firewall the source will be NATed to the VRRP address (hide address)and the destination will still be 216.45.19.33. For the reply from the web server, the source will be 216.45.19.33 and the destination will be the VRRP address until the packets hit the firewall. Once NAT has occured the destination will be changed to the LAN address of your host but the source will still be 216.45.19.33.

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************

 

[Donachie]

ok thanks.

another question regarding this - as all connections are initiated from our side do I only need one rule on the policy - ie allowing outbound access? As checkpoint is stateful then the reply packets should be checked agaihnst the state-table and allowed in this way?

 

[ChrisAC]

Correct. Firewall-1 is fully stateful and so will take care of any replies to outbound initiated connections.

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************

 

[Donachie]

great thanks for that chris.