Network Address Translation - SonicWALL TZ 210 Series Getting Started Manual

TZ_210_GSG.book Page 31 Thursday, November 13, 2008 7:41 PM

Network Address Translation

The Network Address Translation (NAT) engine in SonicOS
Enhanced allows users to define granular NAT policies for their
incoming and outgoing traffic. By default, the SonicWALL
security appliance has a preconfigured NAT policy to perform
Many-to-One NAT between the systems on the LAN and the IP
address of the WAN interface. The appliance does not perform
NAT by default when traffic crosses between the other
interfaces.
You can create multiple NAT policies on a SonicWALL running
SonicOS Enhanced for the same object – for instance, you can
specify that an internal server uses one IP address when
accessing Telnet servers, and uses a different IP address for all
other protocols. Because the NAT engine in SonicOS Enhanced
supports inbound port forwarding, it is possible to access
multiple internal servers from the WAN IP address of the
SonicWALL security appliance. The more granular the NAT
Policy, the more precedence it takes.
Before configuring NAT Policies, you must create all Address
Objects that will be referenced by the policy. For instance, if you
are creating a One-to-One NAT policy, first create Address
Objects for your public and private IP addresses.
Configuring NAT Policies
NAT policies allow you to control Network Address Translation
based on matching combinations of Source IP address,
Destination IP address, and Destination Services. Policy-based
NAT allows you to deploy different types of NAT simultaneously.
The following NAT configurations are available in SonicOS
Enhanced:
• Many-to-One NAT Policy
• Many-to-Many NAT Policy
• One-to-One NAT Policy for Outbound Traffic
• One-to-One NAT Policy for Inbound Traffic (Reflexive)
• One-to-Many NAT Load Balancing
• Inbound Port Address Translation via One-to-One NAT
Policy
• Inbound Port Address Translation via WAN IP Address
SonicWALL TZ 210 Series Getting Started Guide Page 31