This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't enable NAT rules because of "network group objects"

Hi,

since update 9.002-12 I can't create or enable/disable my DNAT rules which use a network group object. In this object I have my Uplink Primary Addresses because I have two internet connections.

Error msg is:
The NAT rule object cannot use network group objects for the traffic destination attribute when using this NAT mode.

So I was wondering why this has been disabled? Or maybe it's a bug?

This thread was automatically locked due to age.

0 BarryG over 12 years ago

Hi, please post a screenshot of the DNAT you're trying to create.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 zumtest over 12 years ago in reply to BarryG

Hi, please post a screenshot of the DNAT you're trying to create.

Barry

Here you go
- nat_rule.png
- View
- Hide
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 12 years ago

In general, you want to avoid filling in an unchanging field in a NAT rule. I wonder if this rule didn't just get crossways with you. [;)]

Try deleting this rule and creating it from scratch without FTP in the last field. Did that work?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 zumtest over 12 years ago in reply to BAlfson

In general, you want to avoid filling in an unchanging field in a NAT rule. I wonder if this rule didn't just get crossways with you. [;)]

Try deleting this rule and creating it from scratch without FTP in the last field. Did that work?

Cheers - Bob

I tried to create it from scratch but it doesn't let me save it. It doesn't like my "Upling Primary Addresses" object.

It worked before that's why I have some rules which are active and working fine.
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 12 years ago

Use an Availability Group instead of a Network Group.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 zumtest over 12 years ago in reply to Scott_Klassen

Use an Availability Group instead of a Network Group.

This doesn't work because this type of group is for hosts.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 12 years ago

Ahhh - it doesn't like the 'Uplink Primary Addresses' object! You know, I never thought to try that. I've always used a regular 'Network Group' with the "Interface (Address)" and "Interface [Add'l Address] (Address)" objects instead.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 zumtest over 12 years ago in reply to BAlfson

So I did a little more testing which version broke it.

9.000-8 - works fine
9.001-18 - doesn't work anymore
9.002-12 - still doesn't work
9.003-15 - still doesn't work

So I think this is a real bug. Guess I will go back to the first release or ASG8 until this is fixed.
Cancel
Vote Up 0 Vote Down

Cancel
0 Rinat over 12 years ago in reply to zumtest

Hi. Any news when it will be fixed?? I have 2 WAN's and it's very annoying that I lost an ability to use uplink primary interfaces group object. BTW I'm running 9.003-16
Cancel
Vote Up 0 Vote Down

Cancel
0 Ol Deda over 12 years ago

why you don't use 2 NAT rules for wan1 and wan2 ?
Cancel
Vote Up 0 Vote Down

Cancel