INBOUND AND OUTBOUND NAT

Transcription

1 INBOUND AND OUTBOUND NAT Network Address Translation Course #

2 Overview! Network Address Translation (NAT)! Aliases! Static Address Mappings! Inbound Tunnels! Advanced Tunnel Option SYN Cookies Authentication Hide Source Time Groups Traffic Shaping Inbound Load balancing 2

3 Network Address Translation! Network Address Translation (NAT) translates an IP address behind the firewall to the IP address of the external network interface, disguising the original IP address. Using NAT makes it possible to use a non-registered IP address within protected networks and PSNs, while still presenting a registered IP address to the external network (typically the Internet).! NAT is active by default on all GTA firewalls.! NAT is applied to outbound packets from: A protected network to an external network A protected network to a PSN A PSN to an external network A protected network to another protected network! NAT can be used with both IPv6 and IPv4 Networks. 3

4 ! Outbound Port Address Translation (PAT) Only occurs when a source port is already in use and destination IP address and port is the same. This occurs dynamically.!!!! Inbound Port redirection in a tunnel and is statically configured. 4

5 Aliases! What is an Alias? Is when a physical network interface (NIC) has more than one IP Address associated with it. IP aliases allow multiple hosts to have tunnels that require the same port. For example, one alias could be used to direct an SSH tunnel to a web server on the PSN (1a), while another alias directs a second SSH tunnel to an internal-only file server on the protected network (1b). IP aliases allow separation of outgoing traffic to multiple IP addresses. For example, an outgoing connection from a personal computer might have all of its FTP traffic routed to one external alias for the purpose of bandwidth tracking.! How many Aliases can a firewall have? The number of aliases available on a firewall is product dependent. GB-250 firewall allows 5. GB-2500 firewall allows up to

6 Aliases! Aliases are added to a firewall in [Configure -> Network -> Interfaces -> Aliases] section. Interface can have multiple Aliases Any Interface may have an alias. GB-OS Supports both IPv4 and IPv6 Aliases.! Added an alias Click new Enter a Unique Name Description (Optional) Select the Interface the alias will be on. Enter Alias IP. 6

7 Aliases Aliases in a different network than one of the existing Logical Interfaces must have a netmask. 7

8 Alias Ranges! It is possible to alias a range of IP addresses.! In the address location enter the beginning IP Address and the End IP address. 8

9 Aliases ARP & Routing Tables Aliases and Interface Address will display in the firewall routing table and arp table. 9

10 Static Address Mappings! By default all packets exiting an interface are Mapped to the IP address assigned to the Firewalls Interface.! Allows a firewall administrator to map an internal host to a different IP address on the interface the packet exits.! Mapping can be based on Single IP address Network Range of IP addresses Service such as TCP Port 80! The number of Static Mappings are product dependent.! Requirements for Static Address Mapping is an Alias configured on the firewall. 10

11 Why Use a Static Address Mapping?! Public IP Address assigned to a Mail Server may be an alias on the firewall. Outbound packets should be NAT ed to the Alias that the MX Record points to. Or may be dropped due to RDNS.! Remote Sites may filter on source IP address for connections. And Internal host(s) may need to be NAT ed to a specific IP.! Some port less services such as PPTP or GRE may work better if Internal host is NAT ed to a different IP address. 11

12 Configuring a Static Address Mapping.! Go to [Configure -> Network - > NAT -> Static Mappings] insert a new or edit an existing static map.! Enter User Defined Description! Select Source Object, or enter a User Defined Address.! Select a Service! Select an Alias Name from the To Drop Down List.! Click OK and Save. Important - Order is important. Sort the list to the correct order. 12

13 Map based on a destination IP 13

14 Testing a Static Mapping Before Mapping After Mapping 14

15 Inbound Tunnels Inbound tunnel connect an external IP and port number to an internal IP address and port number using Network Address Translation. Sometimes referred to as port forwarding 15

16 Example Configuration Using HTTP (TCP Port 80) Go to [Configure -> Network -> NAT -> Inbound Tunnels]! Insert a new tunnel Disable Unchecked Description User Defined Service Select service to tunnel inbound or select user define to define. In example above this is http. Select interface or Alias for the public IP Address on the firewall. Select object which contains the web server IP or select user define and enter the web server IP. Click OK.! Save Tunnel section.! Access is now allowed inbound using NAT via the tunnel. 16

17 Accessing Tunnel Example HTTP / TCP 80 When a web browser is opened and URL is entered. Host will resolve the URL to an IP Address and connect to the IP on port 80. External IP port combination is directed to internal host on specified port. External host only see Public IP and not the internal private IP. 17

18 Inbound Port Redirection Used when only a single or limited IP address are available for accessing different internal hosts. Inbound port redirection will change the destination port a host connects to on the firewall to a hosts internal IP and port. Use the format of Port# -> Port# 18

19 Inbound Port Redirection 19

20 Using Ranges in Tunnel! Port Ranges used in Tunnels will create a tunnel on each port the range covers.! Range for the ports is defined by Setting Service to User Define Enter ports in form of port#-port# 20

21 Using Service Objects! By using Service Groups a single tunnel definition can contain multiple tunnels.! Service Object Web&FTP contains FTP Http Https TCP Port

22 Inbound Load Balancing! Use a to Address of an object with multiple IP address.! Use a round robin inbound load balancing.! No checking if target host is down.! Only appropriate for service such as http 22

23 Advanced Tunnel Options! Automatic Policies enabled by default, create a policy to allow connection to the Source of the tunnel on specified port.! Hide Source Performs inbound Network Address translation. The internal server or host will see all connections as coming from the firewall. Used correct routing problems Trick firewalls that only allow connections from local networks.! Authentication Enable if users are required to authenticate prior to accessing the tunnel.! IPS Applies Intrusion Prevention Polices to the tunnel connections.! Source IP Address Allows an administrator to define specific IP addresses allowed to connect to the tunnel. Used in conjunction with Automatic Policy to restrict access.! SYN Cookies - Advanced SYN Flood protection.! Time Groups Used specify a time period the tunnel is active.! Traffic Shaping Restrict the amount of bandwidth connections to the tunnel may use. 23

24 Hide Source! Problem Internal Host sees packet from an external hosts and responds via it default gateway or route. In the example above the default gateway is another firewall. 24

25 Hide Source! By suing Hide source on an inbound tunnel the internal host will see the connection as coming from the local firewall/ gateway and respond to the local IP.! The firewall will then forward packets back to the sending host. 25

26 Trouble Shooting! Aliases If Alias does not respond to pings or allow connections remotely. Confirm no other hosts have the same IP Address assigned. Confirm no others tunnels over ride the service. Increasing a user limited systems user licenses does not allow more aliases to be configured.! Static Address Mappings Are order dependent. The first match for a Static Address Mapping is used. Make sure the Static Mappings are in the correct order. If a mapping is not working as expect confirm the alias is on the correct interface.! Inbound Tunnels Tunnels Over ride firewall Services. If you have a tunnel for SMTP. This will over ride the firewall Mail Sentinel Service. Tunnel Order is important. First tunnel matched will over ride other tunnels. 26

27 If you require additional assistance or have additional questions please contact GTA Technical Support. Customer Support Line Phone: Normal Hours EST U.S. Free User Support 8/7/2013 Global Technology Associates, Inc.