SD-WAN

 View Only

  • 1.  VPNC for inbound NAT

    Posted Jan 21, 2021 09:21 AM
    If customer wanted to host a public accessible webserver behind the VPNC, I htink it will work if
    1. using destination NAT policy - user hitting VPNC public IP on a particular port, this will be Dst-NAT to the webserver
    2. have a public IP DMZ hosted by VPNC - user hit the public IP of the webserver, routed through and allowed in policy by the VPNC, the DMZ is just a separate internal network with public IP

    I am not sure if VPNC can do inbound NAT like a typical Cisco/Juniper/etc firewall where a public IP is translated to private IP?

    Thanks.

    ------------------------------
    Kenneth Tan
    ------------------------------


  • 2.  RE: VPNC for inbound NAT

    Posted Jan 21, 2021 05:11 PM
    yes this is supported. obviously you need to have a separate pub IP address for that server that you want to do 1:1 NAT

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba.
    ------------------------------



  • 3.  RE: VPNC for inbound NAT

    Posted Jan 21, 2021 05:17 PM
    Thanks Ariya, do I need to turn on proxy local ARP if I want to use 1:1 NAT?

    ------------------------------
    Kenneth Tan
    ------------------------------

    Original Message


  • 4.  RE: VPNC for inbound NAT

    Posted Jan 21, 2021 05:34 PM
    not to the best of my knowledge. but first test it without it and see

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba.
    ------------------------------

    Original Message


  • 5.  RE: VPNC for inbound NAT

    Posted Jan 23, 2021 07:11 AM
    Hi Kenneth,

    I have a branch gateway running in my home lab as my ISP router and have the need to forward some ports to internal resources. 
    just check my blog post about it:

    https://www.flomain.de/2020/01/port-forwarding-with-sd-branch/

    BR
    Florian

    ------------------------------
    -------------------------------------------------------------------------------
    Florian Baaske
    -------------------------------------------------------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
    -------------------------------------------------------------------------------
    Also visit the AirHeads Youtube Channel:
    https://www.youtube.com/channel/UCFJCnuXFGfEbwEzfcgU_ERQ
    -------------------------------------------------------------------------------
    Feel free to visit my personal Blog
    https://www.flomain.de
    ------------------------------

    Original Message


  • 6.  RE: VPNC for inbound NAT

    Posted Jan 24, 2021 11:23 PM
    If the public (it's not gateway interface IP) to private IP mapping is defined under Central - Devices - Gateway - Interface- Pool Management - Static 1:1 NAT, do I need need Dst-NAT in firewall policies, or just permit would do?

    ------------------------------
    Kenneth Tan
    ------------------------------

    Original Message


  • 7.  RE: VPNC for inbound NAT

    Posted Jan 27, 2021 07:45 AM
    Just tested with 1:1 NAT defined, only permit is required in policies, dst-nat is no longer required.

    ------------------------------
    Kenneth Tan
    ------------------------------

    Original Message


Related Content