Nat Behavior; Secondary Ip Addresses; Using 1-To-1 Nat - Watchguard Firebox X20E User Manual

Static NAT
Static NAT is usually known as "port forwarding. " When you use static NAT, you use the primary exter-
nal IP address of your Firebox X Edge e-Series instead of the IP address of a public server. You could do
this because you want to, or because your public server does not have a public IP address. Traffic to
that internal server is sent to a port on the public IP address of your Firebox X Edge. The Edge uses
Static NAT to send the traffic on that port to the server behind the Edge.
For example, you can put your SMTP email server behind the Edge with a private IP address and config-
ure static NAT in your SMTP policy. The Firebox X Edge receives connections on port 25 and makes sure
that any SMTP traffic is sent to the real SMTP server behind the Edge.
You configure Static NAT with incoming firewall policies. For more information, see "Enabling Common
Packet Filter Policies" on page 93.

NAT behavior

When you configure NAT:
Each interface on the Firebox X Edge e-Series must use a different TCP subnet.
•
You can have only one trusted network, one optional network, and one external network.
•
You can use a router to connect more subnets to these networks. For more information, see
"Connecting the Edge to more than four devices" on page 16.
The Edge always uses Dynamic NAT for traffic that goes from the trusted or optional networks to
•
the external network.
Dynamic NAT is not applied to BOVPN or MUVPN traffic.
•

Secondary IP addresses

You can assign eight public IP addresses to the primary external interface (WAN1). These addresses are
used for 1-to-1 NAT.
When you configure secondary IP addresses on the external network:
The primary IP address must be a static IP address.
•
The first IP address is the primary IP address.
All secondary IP addresses must be on the same external subnet as the primary IP address.
•
You cannot configure multiple IP addresses for the WAN2 failover interface. The WAN2 interface
•
is reserved for WAN failover, and your failover IP address must be on a different subnet.

Using 1-to-1 NAT

Three steps are necessary to enable 1-to-1 NAT:
You must add at least one secondary external IP address to the Firebox.
•
You can then configure a custom policy for your 1-to-1 NAT rule.
•
You must then enable secondary IP addresses on the Firebox.
•
Adding a 1-to-1 NAT entry
To connect to the System Status page, type https:// in the browser address bar, and the IP
1
address of the Firebox X Edge trusted interface.
The default URL is: https://192.168.111.1
User Guide
Working with Firewall NAT
143