PCs on the Intranet Were Unable to Access the Internal Server Because Intrazone NAT Was Not Configured

Publication Date:  2015-07-03 Views:  238 Downloads:  0
Issue Description
Networking: PC------USG-----server 

NAT server was configured on the USG for users on the intranet and Internet to access the internal server. 

If static port mapping was configured, only some web pages could be displayed for users on the Internet. 


nat server protocol tcp global 10.228.187.128 18888 inside 10.172.10.99 18888 vrrp 5 nat server protocol tcp global 10.228.187.128 18443 inside 10.172.10.99 18443 vrrp 5

When global port mapping was configured, the internal server could be normally accessed. 

nat server protocol tcp global 10.228.187.128 any inside 10.172.10.99 any vrrp 5 
Handling Process
1. The following bidirectional NAT was displayed after global port mapping was configured.

  tcp  VPN: public -> public 
  Zone: trust -> trust  TTL: 00:00:10  Left:  timeout  
  Interface: G0/0/0  Nexthop: 10.172.11.249  MAC: 00-00-5e-00-01-17
  <-- packets:12 bytes:2297   --> packets:18 bytes:3680
  10.172.10.99:46915[10.228.187.128:46915]-->10.228.187.128:18888[10.172.10.99:18888]


2. In addition to ports 18888 and 18443, the PC might also access other ports. However, the packets on the PC indicated that the PC did not access other ports of the server.

3. If the PC did not access other ports, the fault might occur because the server accessed other addresses, and a packet analysis proved so. The server accessed its global address instead of the real destination. To resolve this issue, interzone NAT or global NAT server must be configured.

When the communication between the PC and server was successful, the server (10.172.10.99) initiated access to 10.228.187.128. In this case, the traffic in both directions matched the same NAT server. This scenario is also known as bidirectional NAT. In the case of unsuccessful communication, the source port of the initiator was not 18888. Therefore, the traffic matched NAT in one direction. In this case, the source address of the traffic sent to the server was still 10.172.10.99. However, the request of the PC destined to 10.228.187.128.
Root Cause
The PC accessed the public address mapped to the server through NAT server. However, NAT server was not implemented for the ports. Therefore, intrazone NAT must be configured to resolve the problem. 
Solution
Configure intrazone NAT to resolve the problem. 

END