Network Address Translation and Access Control
NAT types on USG
- Source NAT (NAT policy): translates private source addresses. Easy IP uses the egress interface address; PAT uses an address pool with port translation; No-PAT is one-to-one without port translation.
- NAT Server (destination NAT): publishes an internal server as global IP and port to private IP and port, also called port mapping.
- Bidirectional NAT: source and destination translation in one policy, used when internal users must reach a server by its public address (hairpin).
- NAT ALG: fixes embedded IPs and ports in FTP, SIP and PPTP.
ACL and matching order
ACLs are used for NAT matching, traffic policies and route filters, not as the main security policy on USG. Basic ACL 2000-2999 matches source; advanced ACL 3000-3999 matches source, destination, protocol and port. For outbound traffic the security policy is evaluated before source NAT; for inbound NAT Server traffic, destination translation occurs before the security policy, so the policy matches the private server address.
Worked example
Publish 10.1.1.10:80 as 200.1.1.10:8080. Configuration: nat server protocol tcp global 200.1.1.10 8080 inside 10.1.1.10 80. Policy: Untrust to DMZ, destination 10.1.1.10, service HTTP, permit. Reasoning: the public port differs, but the policy sees the translated private address and the real service port; a policy written with 200.1.1.10 will not match.
Traps that cost marks
- Writing the security policy against the public address for NAT Server.
- Using Easy IP when the ISP requires a fixed public address.
- Forgetting the return route to the NAT pool.
- Treating NAT as a security control; it is not.