FAQ-How to configure NAT source and a NAT address pool in a virtual system in NGFW V5R1

Publication Date:  2016-11-30 Views:  599 Downloads:  0
Issue Description

Scenario:

The administrator of one virtual system intends to implement NAT source by using the IP address of the vitual-if interface for the users that intend to access the internet.

The configuration procedure of source NAT requires the configuration of one NAT IP address pool and of a NAT policy. The below error is received when trying to configure a NAT address pool in a virtual system.


Received error:


[USG-CustomerX]display ip interface brief

Virtual-if11                      10.10.10.1/24          up         up(s)

[USG-CustomerX]nat address-group test

 [USG-CustomerX-vsys-address-group-test]section 10.10.10.1 10.10.10.1

 Error: The specified global IP cannot be used by the current system.



Solution

The error is received when the IP address is not allocated to the virtual system from the root firewall. In order to configure source NAT, NAT server or NAT64  it is required to
first assign one IP address to the virtual system from the root firewall in an exclusive or shared manner by making use of the assign global-ip  command.


Format

assign global-ip start-address end-address { exclusive | free }

undo assign global-ip start-address end-address


Parameters:

        
Exclusive mode - The public IP address assigned in exclusive mode to a virtual system cannot be assigned to other virtual systems.

   Free mode - The public IP address assigned in free mode to a virtual system can still be assigned in free mode only to other virtual systems.



Configuration procedure:


1.Assign the IP address to the virtual system from the root firewall


[USG]vsys name CustomerX

 [USG-vsys-CustomerX]assign global-ip  10.10.10.1  10.10.10.1 exclusive


2.Configure a NAT IP address pool that provides the IP address already assigned to the virtual system


[USG]switch vsys CustomerX

[USG-CustomerX]nat address-group test

[USG-CustomerX-vsys-address-group-test]section 10.10.10.1  10.10.10.1


3.Configure the nat-policy to nat the traffic sourced in the trust zone and destined to the untrust zone by using the nat address pool.


nat-policy

 [USG-CustomerX-policy-nat]rule name 1

 [USG-CustomerX-policy-nat-rule-1]source-zone trust

 [USG-CustomerX-policy-nat-rule-1]destination-zone untrust

 [USG-CustomerX-policy-nat-rule-1]action nat address-group  test



END