topic NAT & Routing in Network Security

NAT & Routing

adamgibs7 — Tue, 12 Mar 2019 09:08:49 GMT

Dears,

i have a perimeter firewall which is connecting to ISP router, ISP provided to me 2 public subnets, one is of /30 and the other of /29 both of different subnets,

I have used /30 subnet between the isp router and the firewall outside interface, i want to use /29 public ip subnet for my servers which will be static natted so here the challenge is how the routing will take place for my /29 public ip address,

ISP will throw the packet on my firewall and how the firewall will come to know that /29 subnet is static natted when no interface is configured with the /29 subnet.

thanks

When you configure NAT the

Jon Marshall — Wed, 29 Mar 2017 16:55:34 GMT

When you configure NAT the firewall takes ownership of the IP. So if a packet arrives with an IP from that block and you have a static NAT statement on your firewall then the firewall will simply translate to the real IP and forward on the traffic,assuming it is allowed.

This is how all L3 devices handle NAT.

Note the above assumes the ISP is routing the /29 to your firewall. There is another way the ISP could do it and you might need additional configuration but the more common way is to route.

Jon

Dear Jon,

adamgibs7 — Fri, 31 Mar 2017 05:17:25 GMT

Dear Jon,

is it proxy arp takes place here.

thanks

Adam

Jon Marshall — Fri, 31 Mar 2017 12:50:07 GMT

Adam

Not when the traffic is routed to your firewall. The other way of doing it that I mentioned however does use proxy arp and that is when the ISP instead of having a route for that subnet pointing to your firewall have a secondary IP address from the new subnet on their router.

So then they would arp for any of the new IPs and your firewall would answer ie. be a proxy for the arp requests.

Jon