topic Re: Hide NAT using "Interface" object in Spark Firewall (SMB)

Hide NAT using "Interface" object

stallwoodj — Thu, 21 Jul 2022 14:52:22 GMT

Hi,

I have a customer with a 1590 - locally managed version R80.20.40.

Their main internet circuit is Ethernet with fixed IP. Dedicated VoIP circuit is PPPoE with dynamic IP.

Automatic Hide NAT for outgoing traffic is OFF as it was interfering with their SIP traffic.

We have source-based static route via PPPoE interface for their VoIP, but in order to NAT it we have to modify the src_adtr object every time the circuit goes down and up again. There appears to be no "This firewall" or even better "This Internet Interface" to create a manual Hide NAT rule with.

Is there a way to do the hide NAT better?

Thanks

Jamie

Re: Hide NAT using "Interface" object

_Val_ — Mon, 25 Jul 2022 07:05:19 GMT

@AntoinetteHodes can you advise?

Re: Hide NAT using "Interface" object

AntoinetteHodes — Mon, 25 Jul 2022 08:07:19 GMT

Hello @stallwoodj, I am not sure if this is possible due to the dynamic IP setup you mention. Static is preferred. The best and quickest way forward would be opening a TAC case as this might be the only workaround.

Re: Hide NAT using "Interface" object

stallwoodj — Mon, 25 Jul 2022 08:13:15 GMT

Thanks, I'll raise an RFE for a "This Gateway" source as Hide NAT.

Re: Hide NAT using "Interface" object

PhoneBoy — Mon, 25 Jul 2022 18:55:17 GMT

With a centrally managed 1590, you could use the "LocalMachine" dynamic object with NAT and it should work fine.
Unfortunately, those dynamic objects are not exposed in local management, thus an RFE would be required.

Re: Hide NAT using "Interface" object

PhoneBoy — Mon, 25 Jul 2022 19:24:44 GMT

Possible way to achieve this is with a host object for the IP address of 0.0.0.0.

Re: Hide NAT using "Interface" object

stallwoodj — Tue, 26 Jul 2022 08:14:41 GMT

Thanks PhoneBoy, I tested this in the lab and it worked straight away!

Re: Hide NAT using "Interface" object

PhoneBoy — Tue, 26 Jul 2022 13:03:50 GMT

Whether this is supported or not is a separate question of course, but glad to hear it worked for you!

Re: Hide NAT using "Interface" object

Chris_Atkinson — Tue, 26 Jul 2022 16:01:16 GMT

sk40637 brings back some related memories 😜

Re: Hide NAT using "Interface" object

PhoneBoy — Tue, 26 Jul 2022 18:20:53 GMT

Considering that SK originated from Nokia, and I know the guy who wrote the article...yeah, I feel you. 🙂