4
Address Translation
80
Example: Enabling traffic to a protected web server in a DMZ (1:1)
This
example
creates
a
SAT
IP
rule
that
will
translate
and
allow
IPv4
flows
from
the
Internet
to
a
web
server
located
in
a
DMZ.
The
SEG
is
connected
to
the
Internet
using
the
wan
interface
with
address
object
wan_ip
(defined
as
195.55.66.77
)
as
IPv4
address.
The
Web
server
has
the
private
IPv4
address
10.10.10.5
and
is
on
the
network
connected
to
the
dmz
interface.
1. Change
the
current
CLI
context
to
be
the
main
IP
rule
set:
Device:/>
cc
IPRuleSet
main
2. Create
a
SAT
IP
rule:
Device:/IPRuleSet/main>
add
IPRule
Action=Allow
Service=http
SourceInterface=any
SourceNetwork=all
‐
nets
‐
ip4
DestinationInterface=core
DestinationNetwork=wan_ip
DestinationTranslation=SAT
SetDestinationAddress=Offset
NewDestinationIP4=10.10.10.5
Name=SAT_HTTP_To_DMZ
3. Return
to
the
default
CLI
context
if
no
more
rules
are
needed:
Device:/IPRuleSet/main>
cc
Device:/>
Many-to-many translation (M:N)
A
single
SAT
rule
can
be
used
to
translate
an
entire
range
of
IP
addresses
(a
many
‐
to
‐
many
translation).
This
results
in
a
transposition
where
the
first
original
IP
address
will
be
translated
to
the
first
IP
address
in
the
translation
address
list
and
so
on.
Port
numbers
are
not
changed.
Example 1: Translating traffic to multiple protected Web servers (M:N)
In
this
simple
example,
a
SAT
IP
rule
will
translate
from
five
IPv4
public
IP
addresses
to
five
Web
servers
located
in
a
DMZ.
The
SEG
is
connected
to
the
Internet
via
the
wan
interface
and
the
public
IPv4
addresses
are
the
range
195.55.66.77
to
195.55.66.81
.
The
Web
servers
have
the
private
IPv4
address
range
10.10.10.5
to
10.10.10.9
and
are
on
the
network
connected
to
the
dmz
interface.
The
SAT
IP
rule
must
translate
the
nth
public
address
to
the
nth
private
server
address.
The
following
steps
need
to
be
performed:
•
Define
an
address
object
containing
all
the
public
IPv4
addresses.
•
Define
another
address
object
set
to
be
the
first
IPv4
address
10.10.10.5
of
the
Web
servers.
•
Publish
the
public
IPv4
addresses
on
the
wan
interface
using
ARP
publish.
•
Create
a
SAT
rule
that
will
perform
the
translation.
•
Create
an
Allow
rule
that
will
permit
the
incoming
HTTP
flows.
