Configure Static NAT (SNAT)

Static NAT (SNAT), also known as port forwarding, is a port-to-host NAT. With static NAT, when a host sends a packet from a network to a port on an external or optional interface, static NAT changes the destination IP address to an IP address and port behind the firewall. If a software application uses more than one port and the ports are selected dynamically, you must either use 1-to-1 NAT, or check whether a proxy on your Firebox manages this kind of traffic. Static NAT also operates on connections from networks that your Firebox protects.

We recommend that you configure Static NAT rather than 1-to-1 NAT, especially if you have a small number of public IP addresses.

You can configure static NAT for connections to an external or optional Firebox interface. You cannot configure static NAT for connections to a trusted or custom interface. You cannot configure static NAT for BOVPN or mobile VPN connections.

You cannot configure static NAT for an optional interface in a Device Configuration Template. For more information about how to configure an SNAT action in a Device Configuration Template, go to Configure an SNAT Action.

When you use static NAT, connections to an internal server can be addressed to a Firebox interface IP address instead of to the actual IP address of the server. For example, you can put your SMTP email server behind your Firebox with a private IP address and configure static NAT in your SMTP policy. Your Firebox then receives connections on port 25 and sends any SMTP connections to the real address of the SMTP server behind the Firebox.

  • In Fireware v12.2 or higher, you can specify an FQDN in a SNAT action in addition to an IP address.
  • In Fireware v12.2.1 or higher, you can specify the primary or secondary IP address of the loopback interface in a static NAT action. You might do this if you have provider-independent public IP addresses, or have internal IP addresses not associated with a specific interface, so that you can still use these IP addresses for NAT.

By default, a static NAT rule does not change the source IP address for inbound traffic. When you add a static NAT action, you can optionally specify a source IP address in the action. Then, when a connection that matches the parameters in your static NAT action is received by your Firebox, it changes the source IP address to the IP address that you specify. You can specify a different source IP address for each SNAT member.

You can also enable port address translation (PAT) in a static NAT action. When you enable PAT, you can change the packet destination to specify a different internal host and a different port.

For a demonstration of how to configure static NAT, see the Video Tutorial Getting Started with NAT.

Add a Static NAT Action

In Fireware Web UI, you must define the static NAT action before you can use it in one or more policies.

In Policy Manager, you can create a static NAT action and then add it to a policy, or you can create the static NAT action from within a policy configuration.

Add a Static NAT Action to a Policy

After you add a SNAT action, you can use the action in one or more policies.

Edit or Remove a Static NAT Action

You can edit an SNAT action from the SNAT action list.

In Policy Manager, you can also edit an SNAT action when you edit a policy.

You can remove any SNAT action that is not used by a policy.

Change Static NAT Global Settings

By default, the Firebox does not clear active connections when you modify a static NAT action. You can change the global SNAT setting so that the Firebox clears active connections that use an SNAT action you modify.

To change the global SNAT setting in Fireware Web UI or Policy Manager:

  1. Select Setup > Global Settings.
  2. Select System > Global Settings.
  3. Select the Networking tab.
  4. In the Traffic Flow section, select the When an SNAT action changes, clear active connections that use that SNAT action check box.

Related Topics

Configure Policy-Based Dynamic NAT

Configuration Example — Set Up a Public Web Server Behind a Firebox

Example Configuration Files — Set Up a Public Web Server Behind a Firebox

Port Forwarding