Pro3060, s/w 4.0.0.12 Enhanced. Reference SonicWall Known Issue #45010
When this firewall was deployed several years ago, I used the DMZ port and one-to-one NAT to map public IPs to private IPs in the DMZ. This has all worked ok up until recently when I started adding more devices in the DMZ. What I discovered is the f/w fails to NAT certain IPs but works with others just fine.
The release notes for SonicWall 4.0.0.5e (enhanced) list this known issue:
" 45010: Symptom: One-to-one NAT policy works with LAN but doesn't work with DMZ interface. Condition: Occurs when using LAN-DMZ mixed bridge mode.
That seems to be exactly what is occurring, except I don't know about "LAN-DMZ Mixed Bridge Mode". Anyway some IPs are NATing just fine, but others don't work at all.
Issue 45010 is not listed in the release notes for subsequent releases like 4.0.0.12 or later, as either still present or fixed. I know for sure that it's still present in 4.0.0.12.
Since SonicWall does not seem inclined to ever fix this, what should I be doing to workaround it? Many-to-Many NAT?
Thanks.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Interfaces X0, X1, and X2 are configured as you list above, where they have different network numbers. However Interface X3 is also in use, and is bridged to X0 in Layer 2 Bridge Mode.
Under Network, Interfaces:
X0's IP is listed as "Primary Bridged I/F"
X3's IP is "Secondary Bridged I/F"
Interfaces X1 and X2 have "Static" IPs. X2 being the DMZ that's causing me grief.
I think it's the bridged X3 (coupled with the "bug") that's your problem. But given there is a bug, I don't see any immediate cure, I'm afraid. Suggest contacting MySonicwall, quoting the known-issue info and asking if they know when it will be fixed. You clearly *should* be able to do what you're doing.
SonicWall has confirmed that this bug is still present in the latest firmware (4.2.0.0), and there is no ETA on fixing it. They also have not provided me with a suitable workaround. The support guy says the issue is now escalated in SW Engineering. OK. But they're also real anxious to close out my support incident, with a promise to contact me in the future if a fix is released. I calculate the odds of them getting back to me are slim to none and there's only a 20% chance of that.
They always hassle you to close the ticket - see if you can out-stubborn them. Keep sending back a "no, please keep it open until resolved" message.
I have to assume that SOMETHING happens, i.e. a ticket which is open more than five days (say) gets flagged up on some supervisor's desk and examined. It could be a good way of making sure the problem is escalated.
Business Accounts
Answer for Membership
by: ccomleyPosted on 2009-06-10 at 02:40:33ID: 24589393
Bridge mode is when you use the SAME ip range on more than one interface.
NORMALLY you would have something like
WAN - 217.123.123.1/26
LAN - 192.168.1.1/24
DMZ - 192.168.25.1/24
i.e. each i/f has a separate range and the sonic routes between.
Mixed-bridge mode is when you have different IPs on some i/fs but the SAME on others. What's your interface config?