[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now


Route Policy

Posted on 2013-10-28
Medium Priority
Last Modified: 2013-10-31
What's the meaning of this rule ?
What's the difference between NAT Policies (under Network) and Access rules (under Firewall) ?

For the rule defined in NAT polices (Inbound & outbound interface), does it mean a rule will be written in Access rule to allow the flow between different zone (eg. Inbound (LAN) and Outbound (WAN) ?  Do I need to manually define it under Access rule ?

Question by:AXISHK
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
LVL 15

Assisted Solution

by:Skyler Kincaid
Skyler Kincaid earned 2000 total points
ID: 39607777
Typically the Access Rules define the ports, IPs and services that are blocked or allowed.

NAT Policies define where the traffic goes and if it is translated at all.

For Example:

You could have an Access Rule that would allow port 80000 from the WAN and a NAT Policy that would take port 80000, translate it to 3389 and send it to your Terminal Server at a specified IP.

But to answer your question:

It basically allows HTTP FTP and VNC to whatever is on from within the internal HP Office Network. I am guessing the x.x.x.x from Translated and Des Original means that no translation takes place.

Expert Comment

ID: 39608234
To over-simplify:

A NAT policy is a router function that allows you to map one IP address to another (inside = outside):

    For example - (inside) could be mapped to (outside)

Access rules are a firewall function that permits traffic to bass between zones:

    For example - You could permit traffic on TCP 80 (HTTP) from the outside to, which would translate to

Author Comment

ID: 39609042
So, Access Rule will be proceeded before NAT Policy and I need to add entries in Access Rule first , correct ?

A NAT rule in NAT policy need a corresponding entry in Access Rule to allow traffic flow between two zones involved in NAT, correct ?

For the attached file,

For HK network (Source) connect to x.x.x.x (public IP - a internal FTP server) , Sonicwall will replace the source header to x.x.x.x (public IP of ftp server) while the destination public IP will be replaced to internal IP of the FTP. Why the NAT appear so strange ?

Moving data to the cloud? Find out if you’re ready

Before moving to the cloud, it is important to carefully define your db needs, plan for the migration & understand prod. environment. This wp explains how to define what you need from a cloud provider, plan for the migration & what putting a cloud solution into practice entails.

LVL 15

Expert Comment

by:Skyler Kincaid
ID: 39609228
Correct. Create the access rules that will be referenced in the NAT policy.

Author Comment

ID: 39610871
Thanks, any idea for the rule defined in the attached file.

"For HK network (Source) connect to x.x.x.x (public IP - a internal FTP server) , Sonicwall will replace the source header to x.x.x.x (public IP of ftp server) while the destination public IP will be replaced to internal IP of the FTP. "

LVL 15

Expert Comment

by:Skyler Kincaid
ID: 39612654
It is really difficult to answer your questions with x.x.x.x substituted for everything.

Author Comment

ID: 39613322
Please refer to the attached file.

Column "Translated" & "Destination Original" are referring to the same IP address.

LVL 15

Accepted Solution

Skyler Kincaid earned 2000 total points
ID: 39613341
Okay so that helps me visualize it more.

For some reason whoever set this up is having any HTTP (port 80), VNC (ports 5800 and 5900), FTP (port 21) that is going to (which I am assuming is server) from inside the network be translated to what appears to be your public IP address.

So if I am on one of your computers using any of the protocols listed (HTTP, VNC, or FTP) and connecting to your server the firewall is going to make it appear as though it is coming from your public IP address instead of from the internal private IP of the computer being used.

I am not sure why they would do this or what the point is. This outline is assuming that the HK Office Network is your internal network.

Featured Post

Plesk WordPress Toolkit

Plesk's WordPress Toolkit allows server administrators, resellers and customers to manage their WordPress instances, enabling a variety of development workflows for WordPress admins of all skill levels, from beginners to pros.

See why 2/3 of Plesk servers use it.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
This article explains the fundamentals of industrial networking which ultimately is the backbone network which is providing communications for process devices like robots and other not so interesting stuff.
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Suggested Courses

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question