4
Address Translation
82
The
required
SAT
rule
is
defined
as
follows:
1. Change
the
current
CLI
context
to
be
the
main
IP
rule
set:
Device:/>
cc
IPRuleSet
main
2. Create
a
SAT
rule
for
the
translation:
Device:/IPRuleSet/main>
add
IPRule
Action=Allow
Service=http
SourceInterface=lan
SourceNetwork=lan_net
DestinationInterface=dmz
DestinationNetwork=dmz_net
SourceTranslation=SAT
SetSourceAddress=Offset
NewDestinationIP4=172.16.0.0
3. Return
to
the
default
CLI
context
using
the
command:
Device:/IPRuleSet/main>
cc
Device:/>
Note:
In
the
above
examples,
IPv4
addresses
are
used.
The
option
NewDestinationIP6=
could
be
used
with
or
instead
of
NewDestinationIP4=
to
perform
the
same
function
with
IPv6
addresses.
A
SAT
IP
rule
can
combine
source
and
destination
translation
in
the
same
rule
if
required.
Many-to-one translation (N:1)
The
SEG
can
be
used
to
translate
ranges
and
groups
into
just
one
IP
address.
Example: Translating traffic to a single Web server (N:1)
This
example
is
similar
to
the
previous
many
‐
to
‐
many
(M:N)
example,
but
this
time
a
SAT
IP
will
translate
from
five
public
IPv4
addresses
to
a
single
Web
server
located
on
a
DMZ
network.
The
SEG
is
connected
to
the
Internet
via
the
wan
interface
and
the
public
IP
addresses
have
the
range
of
195.55.66.77
to
195.55.66.81
.
The
server
has
the
private
IPv4
address
10.10.10.5
and
is
on
the
network
connected
to
the
dmz
interface.
The
following
steps
need
to
be
performed:
•
Define
an
address
object
containing
all
the
public
IP
addresses.
•
Define
another
address
object
set
to
be
the
IP
address
10.10.10.5
of
the
web
server.
•
Publish
the
public
IP
addresses
on
the
wan
interface
using
the
ARP
publish
mechanism.
•
Create
a
SAT
rule
that
will
perform
the
translation.
•
Create
an
Allow
rule
that
will
permit
the
incoming
HTTP
flows.
