Where should do natting

[musthafa786]

Hi,

I have Internet link from ISP , they have given /32 public IP subnet which is using between ISP and our perimeter router  and also they have given separate /29 public IP subnet for our internal purpose , Our perimeter Internet router is connected to firewall and firewall is connecter to our local LAN, firewall is also configured with remote client VPN purpose.

Where should I do natting , whether it on perimeter Internet router or firewall ? , which is best practice? Please help.

Regards,

Musthafa

[Hardik Vaidh]

Hi,

You have to configure NAT in router only.. after that configure routing on your firewall and point LAN traffic toward your firewall gateway....

[blau grana]

Hello Mohammed,

What type of router and firewall do you use? Based on their performance I would do the decision.

From description you have provided so far I would do NATing on Firewall, leaving router do the routing only with public IPs.

Best Regards

Please rate all helpful posts and close solved questions

[musthafa786]

We are using cisco 3825 as wan router and Checkpoint as firewall.

[Bilal Nawaz]

I'd do NAT'ing on the Checkpoint in this case - its much more user friendly on the smart dashboard when configuring NAT and will also verify your policies before pushing the config. (less chance of making mistakes) and im sure the FW has enough grunt in it to handle this without breaking a sweat.

Hope this helps.

Please rate useful posts and remember to mark any solved questions as answered. Thank you.

[blau grana]

I agree with Bilal, in your scenario is better to do NAT on firewall.

In your original post you wrote that VPN client are also terminated on Firewall so it would be better if public IPs will be on Firewall and not behind NAT.

You can better deploy Firewall policy together with NAT rules.

Best Regards

Please rate all helpful posts and close solved questions