Configure Policy-Based Dynamic NAT

In policy-based dynamic NAT, the Firebox maps private IP addresses to public IP addresses. Dynamic NAT is enabled in the default configuration of each policy. You do not have to enable it unless you previously disabled it.

For policy-based dynamic NAT to work correctly, use the Policy tab of the Edit Policy Properties dialog box to make sure the policy is configured to allow traffic out through only one Firebox interface.

1-to-1 NAT rules have higher precedence than dynamic NAT rules. Policy-based dynamic NAT has higher precedence than network dynamic NAT.

In Fireware v12.2 or higher, you can specify the primary or secondary IP address of the loopback interface in the dynamic NAT settings for a policy. You might do this if you have a provider-independent block of IP addresses, and you want to use these addresses without binding them to a specific external interface. You can use provider-independent IP addresses for NAT and Firebox-generated traffic. Firebox-generated traffic is self-generated by the Firebox itself.

For more information about Firebox-generated traffic, see About Policies for Firebox-Generated Traffic.

Disable Policy-Based Dynamic NAT 

Dynamic NAT is enabled in the default configuration of each policy.

See Also

About Dynamic NAT

Give Us Feedback  ●   Get Support  ●   All Product Documentation  ●   Technical Search