NAT & Routing

[adamgibs7]

Dears,

i have a perimeter firewall which is connecting to ISP router, ISP provided to me 2 public subnets, one is of /30 and the other of /29 both of different subnets,

I have used /30 subnet between the isp router and the firewall outside interface, i want to use /29 public ip subnet for my servers which will be static natted  so here the challenge is how the routing will take place for my /29 public ip address,

ISP will throw the packet on my firewall and how the firewall will come to know that /29 subnet is static natted when no interface is configured with the /29 subnet.

thanks

[Jon Marshall · Accepted solution]

When you configure NAT the firewall takes ownership of the IP. So if a packet arrives with an IP from that block and you have a static NAT statement on your firewall then the firewall will simply translate to the real IP and forward on the traffic,assuming it is allowed.

This is how all L3 devices handle NAT.

Note the above assumes the ISP is routing the /29 to your firewall. There is another way the ISP could do it and you might need additional configuration but the more common way is to route.

Jon

[adamgibs7]

Dear Jon,

is it proxy arp takes place here.

thanks

[Jon Marshall]

Adam

Not when the traffic is routed to your firewall. The other way of doing it that I mentioned however does use proxy arp and that is when the ISP instead of having a route for that subnet pointing to your firewall have a secondary IP address from the new subnet on their router.

So then they would arp for any of the new IPs and your firewall would answer ie. be a proxy for the arp requests.

Jon