NAT Reflection

To do this, you would need to create a Business Application Rule with the following details:

Non HTTP Based Policy

Host: Create an IP Host with a Network definition of your internal network (i.e. 192.168.1.0/24)

Source Zone: LAN

Hosted Address: Create an IP Host definition for the external IP you're wanting to reflect

Protected Zone: LAN

Protected Application Servers: Create an IP Host definition which you want to reflect the connections to

Forward all the ports or create specific port forwarding definitions (take note, you can't do a TCP & UDP forward in one rule, you will 2 rules, one for TCP ports and one for UDP ports if you aren't going to forward all ports).

Rewrite Source Address: On

Use Outbound Address: Create a NAT Policy with the Internal IP of the XG. You do this to prevent an asynchronous route, because the sending IP of the device is internal, the internal IP you're reflecting the data to will be dropped by the device because it's not expecting a connection from an internal address, it's expecting it from an external.

Log Firewall Traffic: On

That should be what you need to do. If this was the UTM, it would be called a Full NAT rule :)

To do this, you would need to create a Business Application Rule with the following details:

Non HTTP Based Policy

Host: Create an IP Host with a Network definition of your internal network (i.e. 192.168.1.0/24)

Source Zone: LAN

Hosted Address: Create an IP Host definition for the external IP you're wanting to reflect

Protected Zone: LAN

Protected Application Servers: Create an IP Host definition which you want to reflect the connections to

Forward all the ports or create specific port forwarding definitions (take note, you can't do a TCP & UDP forward in one rule, you will 2 rules, one for TCP ports and one for UDP ports if you aren't going to forward all ports).

Rewrite Source Address: On

Use Outbound Address: Create a NAT Policy with the Internal IP of the XG. You do this to prevent an asynchronous route, because the sending IP of the device is internal, the internal IP you're reflecting the data to will be dropped by the device because it's not expecting a connection from an internal address, it's expecting it from an external.

Log Firewall Traffic: On

That should be what you need to do. If this was the UTM, it would be called a Full NAT rule :)

Thanks! That did it!

Excellent! Glad to have helped

Hi. Is there a way to reflect all domain requests back internally and allow the existing business application rules to apply? e.g. if I own example.com and it is my IP/FFQDN - example.com:80, example.com:5555, example.com 45000 all get reflected back internally and are forwarded according to existing BAR policies so that I don't have to create and manage rules for each?