topic Re: Translate destination on client side in Firewall and Security Management

Translate destination on client side

Jarvis_Lin — Sat, 16 Mar 2019 17:18:21 GMT

Hi CheckMates,

Per sk85460 says:

Detailed example:

Server side scenario:

If the correct static host/network route for "Destination/Server" was added into the routing table of the underlying operating system, the packet will be routed corrected to the outbound interface eth1.

I add 172.16.0.100 as below, but not work.

In this case, what routed I should add ?

Re: Translate destination on client side

PhoneBoy — Sun, 17 Mar 2019 15:52:02 GMT

If the NAT IP is 172.16.0.100 and the real IP is 10.0.0.100, you would add a route for 172.16.0.100 with 10.0.0.100 configured as the nexthop.

That said, I'm not sure why you're doing this as the the default configuration (with Translate Destination on Client Side enabled) does not require a route like this.

Re: Translate destination on client side

Vladimir — Sun, 17 Mar 2019 19:49:23 GMT

Please remove this manual route and configure Static NAT in the properties of the Object of your server entering it's "Public" IP in the NAT tab.

This will create an automatic Proxy ARP entry on the "external" interface and will accept and forward traffic to the destination.

As far as routes go, both, Internal and External networks are going to be shown in your "Connected Routes".

Re: Translate destination on client side

Jarvis_Lin — Mon, 18 Mar 2019 03:38:23 GMT

Hi PhoneBoy,

I just LAB (Translate destination on client side / Translate destination on server side), because in this case (Translate destination on server side) I can not LAB success.

"If the correct static host/network route for "Destination/Server" was added into the routing table of the underlying operating system, the packet will be routed corrected to the outbound interface eth1."

Re: Translate destination on client side

PhoneBoy — Mon, 18 Mar 2019 04:03:08 GMT

You add the route with the nexthop of an IP address, not an interface. The IP address will be on eth1, which will cause the traffic to be routed out eth1. Make sense?

Re: Translate destination on client side

Jarvis_Lin — Mon, 18 Mar 2019 06:38:29 GMT

My Lab topology is show as below:

I create 2 NAT rule :

When translate on client side is check, I can revived web portal. fw monitor show as below:

When translate on client side is uncheck, fw monitor show as below:

but O is not current, it should be eth0, show I add routing as below:

fw monitor:

now it looks current interface, but still can't received web portal.

so I add web server second IP 10.8.2.80. and it is work. I can received web portal. fw monitor is show as below

In my lab, is it connection or route issue with access web portal even I add route?

or this is current configuration for this lab (translate on server side) ?

Re: Translate destination on client side

Jarvis_Lin — Mon, 18 Mar 2019 10:22:59 GMT

My Lab topology is show as below:

I create 2 NAT rule :

When translate on client side is check, I can revived web portal. fw monitor show as below:

When translate on client side is uncheck, fw monitor show as below:

but O is not current, it should be eth0, show I add routing as below:

fw monitor:

now it looks current interface, but still can't received web portal.

so I add web server second IP 10.8.2.80. and it is work. I can received web portal. fw monitor is show as below

In my lab, is it connection or route issue with access web portal even I add route?

or this is current configuration for this lab (translate on server side) ?