Matching sequence of firewall security policies and NAT policies

Popeye_Wang · Created May 27, 2021 03:30:01

Hello,

According to the NAT service process:

Destination NAT is performed before security policy check, and therefore the destination address in the security policy must be set to the post-NAT address.
Source NAT is performed after security policy check, and therefore the source address in the security policy must be set to the pre-NAT address.

That is, the source and destination IP addresses specified in a security policy are the actual source and destination IP addresses.

NAT

Any further questions, please let us know.

Popeye_Wang · Created May 27, 2021 03:30:01

Hello,

According to the NAT service process:

Destination NAT is performed before security policy check, and therefore the destination address in the security policy must be set to the post-NAT address.
Source NAT is performed after security policy check, and therefore the source address in the security policy must be set to the pre-NAT address.

That is, the source and destination IP addresses specified in a security policy are the actual source and destination IP addresses.

NAT

Any further questions, please let us know.

Unicef · Created May 27, 2021 06:36:35

Good answer

user_4143345 · Created May 28, 2021 09:13:22

Thanks.

andersoncf1 · Created May 28, 2021 11:07:52

Community members have already brought in accurate information.

Unicef · Created Jul 20, 2021 09:43:41

Helpful