NAT question...

smehrnia — Tue, 12 Mar 2019 02:11:08 GMT

Hi Experts,

Quick question, if i want to do NAT exception for ALL ip traffic on an interface in version 8.4(2). what should i do?

just want to double check it... would it work or should i use another method: nat (interface,any) source static any any

Thanks,

Soroush.

Re: NAT question...

Jouni Forss — Thu, 11 Jul 2013 18:50:23 GMT

Hi,

I guess you already asked something like this on the previous thread.

If you situation is still so that NO HOSTS need to be NATed through the firewall then you can simply LEAVE OUT ALL NAT configurations.

Generally when people need to exempt hosts from NAT they usually only have certain destination networks for which this should apply. (VPN connections). So you usually define destination parameters for the NAT configuration also.

Then you might naturally have public subnets behind the firewall that dont need NAT. As long as no other NAT rule matches these public subnets as a source then you can simply leave out all NAT configuration.

From what I tested I wouldnt probably suggest the above NAT configuration even though I mentioned it in the other thread. It might possibly even cause problems.

I would suggest the other format which basically is that you define the source networks behind that interface under an "object-group network" and then configure the NAT rule

object-group network NETWORKS

network-object

nat (interface,any) source static NETWORKS NETWORKS

Pretty hard to say more than that when dont have exact picture of the situation.

- Jouni

topic Re: NAT question... in Network Security

NAT question...

Re: NAT question...