topic Re: FTD static nat question in Network Security

FTD static nat question

Scott_22 — Sat, 09 Mar 2019 01:17:31 GMT

There's a good chance I'm doing this wrong, but when I try to forward more than one port on my FTD box, it gives me the following error:

Here's the current rule in CLI:

nat (LAN-Side,ISP-Side) static interface service tcp ssh ssh

Any idea why it won't let me add another PAT entry?

Re: FTD static nat question

Marvin Rhoads — Sat, 09 Mar 2019 03:01:04 GMT

Make the services (ports) you want to allow part of a service group (via Object Management) and then use that group in the (single) NAT rule.

Re: FTD static nat question

Scott_22 — Sat, 09 Mar 2019 16:44:30 GMT

I attempted that by using the manual NAT entry, but continued having the same issue. See the error below after adding the object group.

Re: FTD static nat question

Marvin Rhoads — Mon, 11 Mar 2019 14:45:28 GMT

You can do it with two rules. They should be Manual NAT ("NAT Rules Before") and not Auto NAT. The source port should be "any" since a client will use a random ephemeral port.

Also remember to allow the traffic with an ACL. You can use the group for that to keep it simple.

Here's the running-config, the first two lines reflect your NAT use case:

> show running-config nat
nat (Outside-Home,Inside-Lab) source static any any destination static Outside_interfrace Jump_server service SVC_158913793770 SVC_158913793770
nat (Outside-Home,Inside-Lab) source static any any destination static Outside_interfrace Jump_server service SVC_158913793771 SVC_158913793771
nat (Inside-Lab,Outside-Home) source static Lab_net Lab_net destination static VPN_Pool VPN_Pool description NAT Exemption
nat (Inside-Lab,Outside-Home) source static Lab_net Lab_net destination static FTDv-2_DMZ FTDv-2_DMZ no-proxy-arp
nat (Outside-Home,Inside-Lab) source static Condo_net Condo_net destination static Lab_net Lab_net
!
object network Lab_net
 nat (Inside-Lab,Outside-Home) dynamic interface
>

Re: FTD static nat question

Scott_22 — Thu, 14 Mar 2019 14:26:22 GMT

Thanks for your Marvin! I will give this a shot and let you know if it works.