Solved

Route Policy

Posted on 2013-10-28
8
291 Views
Last Modified: 2013-10-31
What's the meaning of this rule ?
What's the difference between NAT Policies (under Network) and Access rules (under Firewall) ?

For the rule defined in NAT polices (Inbound & outbound interface), does it mean a rule will be written in Access rule to allow the flow between different zone (eg. Inbound (LAN) and Outbound (WAN) ?  Do I need to manually define it under Access rule ?


Tks
Route-Policy.png
0
Comment
Question by:AXISHK
  • 4
  • 3
8 Comments
 
LVL 15

Assisted Solution

by:Skyler Kincaid
Skyler Kincaid earned 500 total points
Comment Utility
Typically the Access Rules define the ports, IPs and services that are blocked or allowed.

NAT Policies define where the traffic goes and if it is translated at all.

For Example:

You could have an Access Rule that would allow port 80000 from the WAN and a NAT Policy that would take port 80000, translate it to 3389 and send it to your Terminal Server at a specified IP.

But to answer your question:

It basically allows HTTP FTP and VNC to whatever is on 10.0.23.210 from within the internal HP Office Network. I am guessing the x.x.x.x from Translated and Des Original means that no translation takes place.
0
 
LVL 3

Expert Comment

by:ltechsolutions
Comment Utility
To over-simplify:

A NAT policy is a router function that allows you to map one IP address to another (inside = outside):

    For example - 192.168.1.5 (inside) could be mapped to 216.93.183.57 (outside)

Access rules are a firewall function that permits traffic to bass between zones:

    For example - You could permit traffic on TCP 80 (HTTP) from the outside to 216.93.183.57, which would translate to 192.168.1.5.
0
 

Author Comment

by:AXISHK
Comment Utility
So, Access Rule will be proceeded before NAT Policy and I need to add entries in Access Rule first , correct ?

A NAT rule in NAT policy need a corresponding entry in Access Rule to allow traffic flow between two zones involved in NAT, correct ?

For the attached file,

For HK network (Source) connect to x.x.x.x (public IP - a internal FTP server) , Sonicwall will replace the source header to x.x.x.x (public IP of ftp server) while the destination public IP will be replaced to internal IP of the FTP. Why the NAT appear so strange ?

Tks
0
 
LVL 15

Expert Comment

by:Skyler Kincaid
Comment Utility
Correct. Create the access rules that will be referenced in the NAT policy.
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 

Author Comment

by:AXISHK
Comment Utility
Thanks, any idea for the rule defined in the attached file.

"For HK network (Source) connect to x.x.x.x (public IP - a internal FTP server) , Sonicwall will replace the source header to x.x.x.x (public IP of ftp server) while the destination public IP will be replaced to internal IP of the FTP. "

Tks
0
 
LVL 15

Expert Comment

by:Skyler Kincaid
Comment Utility
It is really difficult to answer your questions with x.x.x.x substituted for everything.
0
 

Author Comment

by:AXISHK
Comment Utility
Please refer to the attached file.

Column "Translated" & "Destination Original" are referring to the same IP address.

Tks
NATPolicy.png
0
 
LVL 15

Accepted Solution

by:
Skyler Kincaid earned 500 total points
Comment Utility
Okay so that helps me visualize it more.

For some reason whoever set this up is having any HTTP (port 80), VNC (ports 5800 and 5900), FTP (port 21) that is going to 10.0.23.210 (which I am assuming is server) from inside the network be translated to what appears to be your public IP address.

So if I am on one of your computers using any of the protocols listed (HTTP, VNC, or FTP) and connecting to your server the firewall is going to make it appear as though it is coming from your public IP address instead of from the internal private IP of the computer being used.

I am not sure why they would do this or what the point is. This outline is assuming that the HK Office Network is your internal network.
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Network Config 9 53
[Win7/Win2000] Workstations loosing connectivity to the FileServer 6 23
ESXi VLAN Lab 2 32
server plus 2 43
#Citrix #Citrix Netscaler #HTTP Compression #Load Balance
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now