05-05-2020 02:46 AM
Hi all
I realize I'm missing something and need some assistance. I have multiple "DMZ" interfaces sharing the same security zone, "DMZ" and I tried to make a manual Dynamic PAT rule for one of these traffic flows. I want traffic from the inside zone to be address translated when passing from inside to the "DMZ-2" interface.
I created the rule in FMC with the source zone and destination zone selected, original source I set to the inside source network, original destination to the DMZ-2 subnet, translated source to "Destination Interface IP" and Translated destination to "DMZ-2" subnet.
The thing is when I look at the connections in the FTD I see them being sent to another interface in the DMZ zone that has a totally different subnet. Am I missing something? Shouldn't me selecting the "original destination" be enough for the FTD to figure out which interface to send the traffic to even tough several interfaces are in the same zone?
Regards
Fredrik
05-05-2020 04:19 AM
Hi,
Destination interface is selected based on the Routing purely,i am not sure how you are accessing this service. Are you accessing the destination via IP Address ?
05-05-2020 11:12 PM - edited 05-05-2020 11:42 PM
Hi
Routing would be my guess as well but it seems the destination is chosen from the first interface in the zone. The access is IPv4.
Below is a few configuration snippets and connection events from a working and non-working config
Working setup where the destination subnet is part of a larger group of NAT excempt subnets
nat (any,any) after-auto source static GLO-InternalNets GLO-InternalNets destination static GLO-InternalNets GLO-InternalNets no-proxy-arp show connection
TCP FNB-OT_PAsystem 10.243.12.18:80 FNB-ClientNet 192.168.42.151:61271, idle 0:00:02, bytes 0, flags U N1 Non working setup where I've tried to tell the FMC/FTD to do a dynamic PAT. FNB-OT_PAsystem is the intended destination interface nat (FNB-ClientNet,FNB-OT_NauticAI) source dynamic FNB-ClientNet interface destination static FNB-OT_PAsystemNet FNB-OT_PAsystemNet nat (FNB-ClientNet,FNB-OT_Autoload) source dynamic FNB-ClientNet interface destination static FNB-OT_PAsystemNet FNB-OT_PAsystemNet nat (FNB-ClientNet,FNB-OT_HVAC) source dynamic FNB-ClientNet interface destination static FNB-OT_PAsystemNet FNB-OT_PAsystemNet nat (FNB-ClientNet,FNB-OT_PAsystem) source dynamic FNB-ClientNet interface destination static FNB-OT_PAsystemNet FNB-OT_PAsystemNet But the traffic is being sent to the interface FNB-OT_NauticAI which is in the same security zone but has a different subnet TCP FNB-ClientNet 10.89.3.1(192.168.42.151):61340 FNB-OT_NauticAI 10.243.12.18:80, idle 0:00:01, bytes 0, flags xaA N1 TCP FNB-ClientNet 10.89.3.1(192.168.42.151):61339 FNB-OT_NauticAI 10.243.12.18:80, idle 0:00:01, bytes 0, flags xaA N1
/Fredrik
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide