After migration from v17.8 to v18 EAP 1, for each firewall rule where the source service is differnet but the outsource IP is the same, NAT rules are created for each firewall rule.

After migrating from v17.5 MR8 to v18 EAP1,

for each firewall rule, a new NAT is created. Since I like to have clean situation clean on XG, now I need to unlink all NAT rules from every single firewall rule and attack (in most cases) the same NAT rule (MASQ where the source ip is the primary WAN ip address and service is different).

If I have a different service from each firewall rule, I can use a single NAT where original service is any. I guess that the service port in firewall rule takes precedence, so does not make sense during the migration to have a lot of NAT rules.

Is that something in Sophos you are considering?

Thanks

0 PMStuart over 5 years ago

NAT rules use Orig SRC, Orig DST, Orig SVC and Inbound and Outbound interface - these criteria then are translated according to Translated SRC, DST and SVC.
If you want to create a rule which translates any service then use ANY as the Orig SVC and Original as the translated SVC
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 lferrara over 5 years ago in reply to PMStuart

Thanks Stuart for your comment.

Mine was an observation. In previous XG version, if people have 50 firewall rules, where for each firewall rule, what changes is just the service port number, the translation mechanism will not look for similarity, but 50 NAT rules will be created. I think you can rethink about the migration process. A single NAT where any any as source, and service can work in this situation.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel