Whether the source address specified in the security policy is the translated address when the source NAT policy is configured

12

The source address specified in the security policy is the address before NAT when the source NAT policy is configured.
When the firewall translates an address in a packet, it searches for the interzone security policy. The firewall translates only the address that passes the security policy check and matches the conditions defined in the interzone policy. Therefore, the source address specified in the interzone security policy is the address before NAT, that is, the private IP address.

Other related questions:
Which source address shall I specify in a security policy on an FW configured with a source NAT policy
Specify a private address (source address) in a security policy on an FW. The private address is the one that is used before source NAT is performed. The FW matches packets with a security policy before enforcing a NAT policy. If the packets match the security policy, the FW performs source NAT for the packets. If the packets do not match the security policy, the FW discards the packets.

Specifying a pre-NAT or post-NAT address as the destination address in the interzone security policy when creating a NAT Server policy
Specifying a pre-NAT or post-NAT address as the destination address in the interzone security policy when creating a NAT Server policy You must specify the post-NAT address as the destination address in the policy. The security policy matching takes place after address translation. Therefore, the destination for the security policies to match must be a private IP address.

Whether the NAT policy of the USG2000 can replace the source IP address and destination IP address simultaneously
The bidirectional NAT function of the USG2000 can bidirectionally translate the destination IP address and source IP address simultaneously.

Whether the interface address of the firewall can be an address in the address pool when the NAT policy is configured
When the NAT No-PAT and triplet NAT policies are configured, do not configure the interface address of the firewall as an interface in the NAT address pool, to prevent the impacts on the access to the firewall.

Which destination address shall I specify in a security policy on an FW configured with NAT server
Specify a private address (destination address) in a security policy on an FW. The private address is the one used after NAT Server is performed. The FW matches packets with server-map entries before enforcing a security policy. After the FW translates destination addresses based on the server-map entries, the FW processes the packets based on the security policy.

If you have more questions, you can seek help from following ways:
To iKnow To Live Chat
Scroll to top