topic Re: VSX - NAT Configuration in Firewall and Security Management

VSX - NAT Configuration

cp_lfr — Fri, 27 Dec 2024 23:47:41 GMT

Good morning,

nice to meet you.

It's my first time I configured VSX, and with humility, I I say I'm having problems configuring the NAT rules.

AS you can see we deployed two VSs (one Internal and one External).

We would like to simplify as much as possible the NAT rules.

For example, we tried to NAT management network (Static NAT rule) behind Public IP, but it does not work.

Any suggestions about and how to configure NAT rules and where (which VS) in the easiest way to see less logs in the SmartDashboard are really appreciated (maybe with some examples).

Is there something wrong? I am really grateful to you.

Thanks, best regards.

Re: VSX - NAT Configuration

AlekzNet — Fri, 27 Dec 2024 23:52:52 GMT

Just a quick suggestion:

> we tried to NAT management network (Static NAT rule) behind Public IP, but it does not work.

This is your idea:

- Real SRC: mgmt network
- Real DST: Any
- Translated Source: the external IP of the firewall (so you configure a dynamic PAT, or "hidden", not "static")
- Translated DST: = (he same as the real DST)

You can use the "hide the traffic behind the external IP", but personally, I prefer an explicit manual NAT rule.

Re: VSX - NAT Configuration

the_rock — Sat, 28 Dec 2024 00:12:52 GMT

Do you have screenshot of how rules are configured?

Re: VSX - NAT Configuration

AlekzNet — Sat, 28 Dec 2024 00:34:32 GMT

It was attached, and now it's deleted. The NAT rule on the screenshot was a static one from, for example, Net1 to Net1. Hence my note about PAT to the external iface.

Re: VSX - NAT Configuration

Jarvis_Lin — Sat, 28 Dec 2024 05:34:05 GMT

When using manual NAT, ensure that Proxy ARP is properly configured and that the "Merge manual proxy ARP configuration" option is selected in the Global Properties under NAT settings.

Re: VSX - NAT Configuration

cp_lfr — Sat, 28 Dec 2024 13:31:29 GMT

Re: VSX - NAT Configuration

cp_lfr — Sat, 28 Dec 2024 13:32:26 GMT

Hello, so, I posted all screenshots!

Re: VSX - NAT Configuration

cp_lfr — Sat, 28 Dec 2024 13:33:54 GMT

Hello, as you can see I posted screenshots.

In case, which IP address do I need to use as a proxy ARP?

Re: VSX - NAT Configuration

cp_lfr — Sat, 28 Dec 2024 13:36:09 GMT

Hello, I posted all screenshots, but I am lost on this configuration 😅, any suggestion about configuration?

Re: VSX - NAT Configuration

AlekzNet — Sat, 28 Dec 2024 23:44:13 GMT

For outgoing PAT (to the external IP of the firewall/cluster) you do not need proxy ARP.

Re: VSX - NAT Configuration

cp_lfr — Mon, 30 Dec 2024 21:52:01 GMT

Hi everyone,

so, at the end, today I simply created an automatic NAT rule (Oject and then Nite, Hide Behing the Gateway).

There is NAT on External VSX (enabled NAT, Hide behind the Gateway).

I think at the moment is the best solution!