Configuring NAT Address Pool Detection

If an intranet user uses a post-NAT public IP address for unauthorized operations on the Internet, the public IP address may be masked by Internet devices. Therefore, other users on the same intranet cannot use this public IP address for normal Internet access. In this case, you can configure NAT address pool detection on the FW. Then the FW uses an IP address in the NAT address pool as the source address to detect an Internet server. If the FW does not receive any response packet within a specific period, the FW will remove the IP address from the NAT address pool to prevent the IP addresses of intranet-to-Internet packets from being translated into this IP address. NAT address pool detection works by referencing a health check template in the address pool. For details on health check, see Health Check.

1. With NAT address pool detection, the FW periodically sends a detection packet to the remote server. The source address of the packet is an address in the address pool.

2. If the FW does not receive any response packet from the remote server with the specified period (the default period is15s and detection packets are sent three times), the FW will remove the IP address (source address of the detection packet) from its address pool and will not use the address for NAT translation.

3. The removed IP address can still be used as the source address of a detection packet to detect the remote server. If a response packet is received from the remote server, the FW adds the IP address to the NAT address pool to perform NAT translation for intranet users.