4
Address Translation
84
Example: Port translation with SAT
This
example
is
very
similar
to
the
1:1
example
near
the
beginning
of
this
section
but
the
port
number
will
also
be
changed
by
the
translation.
A
server’s
private
IP
address
is
wwwsrv_priv
on
the
DMZ
interface.
All
incoming
http
connections
will
be
translated
to
wwwsrv_priv
and
all
ports
in
the
http
service
object's
range
80
‐
85
will
be
translated
to
the
range
1080
‐
1085.
1. Change
the
current
CLI
context
to
be
the
main
IP
rule
set:
Device:/>
cc
IPRuleSet
main
2. Create
a
SAT
rule
for
the
translation:
Device:/IPRuleSet/main>
add
IPRule
Action=Allow
Service=http
SourceInterface=wan
SourceNetwork=all
‐
nets
‐
ip4
DestinationInterface=core
DestinationNetwork=wan_ip
SourceTranslation=SAT
SetSourceAddress=Offset
NewSourceIP4=wwwsrv_priv
SetSourcePort=Offset
NewSourcePort=1000
3. Return
to
the
default
CLI
context
with
the
command:
Device:/IPRuleSet/main>
cc
Device:/>
Combining SAT with NAT in the same rule
Both
SAT
and
NAT
translation
can
be
combined
into
the
same
Allow
IP
rule
by
using
the
options
SourceTranslation=SAT
and
DestinationTranslation=SAT
together.
Example: Combining NAT and SAT
Assume
a
number
of
clients
on
the
internal
protected
lan_net
network
are
surfing
the
public
Internet.
Normally
their
connections
are
routed
out
to
the
Internet
via
the
wan
interface.
However,
sometimes
these
clients
will
try
to
access
their
own
Web
server
that
has
the
private
IP
address
our_server_ip
and
is
located
on
the
local
dmz_net
.
This
will
cause
a
problem
because
a
public
DNS
server
will
resolve
the
local
server’s
domain
name
to
wan_ip,
which
is
the
public
IP
address
of
the
SEG’s
wan
interface
IP.
The
solution
is
to
create
a
SAT
rule
for
the
clients
that
translates
wan_ip
to
our_server_ip
.
However,
NAT
is
also
required
to
handle
the
server
requests
coming
from
the
different
clients
via
the
dmz
interface.
