Source NAT

[zmag]

I have a 620B MR2 patch 3 I have a new server in a DMZ = 192.168.99.36 This server is to be used specifically for billing claims submission and the setup requires only 1 inbound port (tcp/3500) and two outbound ports. My outbound policy includes NAT <dynamic ip pool > x.x.237.2 My inbound policy has a vip as the destination The vip states x.x.237.9 translates to 192.168.99.36 This server is a pre packaged .iso so it has the destination and ports already configured. During the installation of the .iso it runs network checks. The outbound port checks pass. The inbound fails. I look in the analyzer for this traffic and see that it is denied and the inbound traffic has a destination of x.x.237.2 Shouldn' t the VIP cause that inbound traffic to translate to 192.168.99.36? I was thinking that I could also set this up to port forward only tcp/3500 from x.x.237.2 --> 192.168.99.36 :3500 but if I do that and I need tcp/3500 in the future I am stuck.

[rwpatterson]

The outbound traffic will originate from the IP address ONLY when you are not using port forwarding. If using port forwarding, you have to additionally set up an IP pool with that address.

[zmag]

I am not using port forwarding. The VIP statement is external = x.x.237.9 mapped = 192.168.99.36 no port forwarding

[zmag]

It is working now. I set up an ip pool and used that as the source nat outbound. It must be the way to software creates the connection when they send traffic to my network. Thanks for the reply.

[Fortrier]

can you show me the cli commands the gui added?i am in need of a similar setup.

[ede_pfau]

@zmag: did I get that right from your first post that you already used outbound NAT with an IP pool, but assigned .237.2 to your server' s outbound traffic? And then you wondered why the reply traffic came back targeted at .237.2, thus missing the VIP which only translates .237.9 to the internal IP? Now that you' ve found a working solution it' d be nice to post the settings that made things work for you.