How to Configure Security Policies to Allow Source NAT
Source NAT includes NAT involving only source address translation (NAT No-PAT) and NAT involving both source IP address translation and source port translation (NAPT, smart NAT, easy IP, and 3-tuple NAT). The methods for configuring NAT policies are the same regardless of the source NAT type. The only difference is the source NAT address pool.
Source NAT policies and security policies have similar configuration logic. Table 10-1 describes the comparison between source NAT policies and security policies. The matching conditions of both the source NAT policy and security policy are the characteristics of the original data packets for which NAT has not been performed.
Item |
Source NAT Policy |
Security Policy |
|---|---|---|
Source security zone |
Source security zone of traffic |
Source security zone of traffic |
Destination security zone |
Destination security zone of traffic or outbound interface of traffic |
Destination security zone of traffic, that is, the security zone where the outbound interface of the traffic resides |
Source address |
Source IP address of traffic (before NAT) |
Source IP address of traffic (before NAT) |
Destination address |
Destination IP address of traffic |
Destination IP address of traffic |
Service |
Service type of traffic |
Service type of traffic |
Action |
Specify the source address pool (post-NAT address) or outbound interface. |
Permit |
For example, the private network segment 10.1.1.0/24 accesses the Internet (the destination address is uncertain) through NAT. The corresponding source NAT policy and security policy are configured as follows.
Source NAT Policy |
Security Policy |
|---|---|
nat-policy
rule name SNAT_for_Internet
source-zone trust
destination-zone untrust
source-address 10.1.1.0 24
action source-nat address-group Public_Address
|
security-policy
rule name Policy_for_Internet
source-zone trust
destination-zone untrust
source-address 10.1.1.0 24
action permit
|
For 3-tuple NAT, you also need to enable the endpoint-independent filtering function. 3-tuple NAT is mainly used for services initiated by external devices, such as P2P-based voice communication and video transmission. After the endpoint-independent filtering function is enabled, the access requests initiated by an external device are forwarded based on the server mapping table, and security policy check is not performed. If this function is not enabled, you need to configure a reverse security policy from the public network to the private network. By default, the endpoint-independent filtering function is enabled.
[sysname] firewall endpoint-independent filter enable