?
Solved

Watchguard 1:1 Nat Issue

Posted on 2012-04-04
3
Medium Priority
?
752 Views
Last Modified: 2012-08-13
We have an xtm22 watchguard (should be similar on all models) but we have 2 external ip addresses for the sake of this ill use 1.1.1.1 and 1.1.1.2.
the watchguard external ip address is 1.1.1.1 and dynamic nat is using this for outgoing traffic and inbound main services SNAT using this. the issue i have is a webserver using 1:1 NAT of 1.1.1.2 -> 192.168.100.2 is not allowing internal users to connect using the external ip address i.e http://1.1.1.2. (it works fine from the outside)
could the issue be the way the watchguard handles this traffic now its 1:1 nat rather than just an snat like it used to be (which worked fine but outbound traffice wouldnt use 1.1.1.2, it would use 1.1.1.1 which was not wanted.)
0
Comment
Question by:active8it
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 3

Accepted Solution

by:
unsatiated earned 900 total points
ID: 37806129
Please provide a little more detail on the current configuration.  Where does the web server reside?  In a DMZ?  If the server is on the inside lan?  The reason your internal clients cannot browse to the 1.1.1.2 address is because that NAT is based on the external network interface.  You cannot traverse out that interface from your internal network to simply reach a device within your network.  You will require either utilizing the 192.168.100.2 ip address or NAT that IP to a different one on your internal interface.
0
 
LVL 2

Author Comment

by:active8it
ID: 37806274
correction the 1:1 nat is working outbound so for example the webserver does identify itself online as 1.1.1.2.
but to simplify trying to access 1.1.1.2 from other sites etc fails. the watchguard shows unhandled packet for example on http://1.1.1.2. ive tried both snat rule so: 1.1.1.2>snat>192.168.100.2 and also just 1.1.1.2>allow>192.168.100.2 both seem to give same result.
0
 
LVL 3

Expert Comment

by:unsatiated
ID: 37806498
What port are you attempting to connect on?  I assume 80.  In the firewall, have you created a allowance for that port to this server as well?
0

Featured Post

Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will show how Aten was able to supply easy management and control for Artear's video walls and wide range display configurations of their newsroom.
If you're a modern-day technology professional, you may be wondering if certifications are really necessary. They are. Here's why.
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question