How to configure NAT source and a NAT address pool in a virtual system in NGFW V5R1

rayma2010 · Created Apr 1, 2017 09:17:31

The error is received when the IP address is not allocated to the virtual system from the root firewall. In order to configure source NAT, NAT server or NAT64 it is required to
first assign one IP address to the virtual system from the root firewall in an exclusive or shared manner by making use of the assign global-ip command.

Format

assign global-ip start-address end-address { exclusive | free }

undo assign global-ip start-address end-address

Parameters:

Exclusive mode - The public IP address assigned in exclusive mode to a virtual system cannot be assigned to other virtual systems.

Free mode - The public IP address assigned in free mode to a virtual system can still be assigned in free mode only to other virtual systems.

Configuration procedure:

1.Assign the IP address to the virtual system from the root firewall

[USG]vsys name CustomerX

[USG-vsys-CustomerX]assign global-ip 10.10.10.1 10.10.10.1 exclusive

2.Configure a NAT IP address pool that provides the IP address already assigned to the virtual system

[USG]switch vsys CustomerX

[USG-CustomerX]nat address-group test

[USG-CustomerX-vsys-address-group-test]section 10.10.10.1 10.10.10.1

3.Configure the nat-policy to nat the traffic sourced in the trust zone and destined to the untrust zone by using the nat address pool.

nat-policy

[USG-CustomerX-policy-nat]rule name 1

[USG-CustomerX-policy-nat-rule-1]source-zone trust

[USG-CustomerX-policy-nat-rule-1]destination-zone untrust

[USG-CustomerX-policy-nat-rule-1]action nat address-group test

How to configure NAT source and a NAT address pool in a virtual system in NGFW V5R1

Third Party’s Trade Secret

My Followers

Enterprise

Consumer

Corporate

Carriers

How to configure NAT source and a NAT address pool in a virtual system in NGFW V5R1

Third Party’s Trade Secret

My Followers