Web: Example for Configuring Intranet Users to Access the Public Addresses of Intranet Servers

This section provides an example for configuring intranet users to access the public IP addresses of intranet servers.

Networking Requirements

An enterprise has deployed a FW as a security gateway on the intranet border. NAT Server is configured on the FW for the intranet web and File Transfer Protocol (FTP) servers to provide services for Internet users. PC D on the same network segment and security zone with the two servers. Source NAT is configured on the FW so that PC D can use a public address to access the two intranet servers.

The enterprise applies for two public IP addresses:

1.1.1.10 used by intranet servers.
1.1.1.11 into which PC D's private address is translated.

Figure 1 illustrates the networking for a source NAT policy in outbound interface mode. The router is an access gateway on the ISP network.

Figure 1 Networking diagram for NAT Server and source NAT

Data Planning

Item		Data	Description
GigabitEthernet 0/0/1		IP address: 1.1.1.1/24 Security zone: untrust	1.1.1.1/24 is a public address provided by the ISP.
GigabitEthernet 0/0/2		IP address: 10.2.0.1/24 Security zone: dmz	Intranet servers use 10.2.0.1 as the default gateway address.
NAT Server		Name: policy_web Public IP address: 1.1.1.10 Private IP address: 10.2.0.7 Public port: 8080 Private port: 80	When Internet users send traffic to 1.1.1.10 through port 8080, the FW can forward the traffic to the web server based on this mapping entry. On the web server, the private address is 10.2.0.7, and the private port number is 80.
NAT Server		Name: policy_ftp Public IP address: 1.1.1.10 Private IP address: 10.2.0.8 Public port: 21 Private port: 21	When Internet users send traffic to 1.1.1.10 through port 21, the FW can forward the traffic to the FTP server based on this mapping entry. On the FTP server, the private address is 10.2.0.8, and the private port number is 21.
Source NAT policy		Name: policy_nat1 Private address that can access the Internet: 10.2.0.6 Address in a NAT address pool: 1.1.1.11	-
Routing information	Default route	Destination address: 0.0.0.0 Next hop address: 1.1.1.254	Configure a default route on the FW to direct intranet traffic to the ISP network.

Configuration Roadmap

The configuration roadmap is as follows:

Assign IP addresses to interfaces, add the interfaces to security zones, and configure network connectivity.
Configure a security policy for traffic between intranet users and intranet servers.
Configure NAT Server. Configure two server mapping entries, one for the web server and the other for the FTP server.
Configure a source NAT policy to allow PC D to access the intranet servers based on the servers' public address.
Configure a default route on the FW to direct intranet traffic to the ISP router.
Configure static routes destined for public addresses of intranet servers on the router.

Procedure

Set IP addresses for interfaces on the FW and assign the interfaces to security zones.
1. Set the IP address of GigabitEthernet 0/0/1 and assign the interface to a security zone.
  1. Choose Network > Interface.
  2. In Interface List, click of GigabitEthernet 0/0/1 and set the parameters as follows:
    
    Zone
    
    untrust
    
    IPv4
    
    IP Address
    
    1.1.1.1/24
  3. Click OK.
2. Set the IP address of GigabitEthernet 0/0/2 and assign the interface to a security zone.
  1. In Interface List, click of GigabitEthernet 0/0/2 and set the parameters as follows:
    
    Zone
    
    dmz
    
    IPv4
    
    IP Address
    
    10.2.0.1/24
  2. Click OK.
Configure a security policy for traffic between users and intranet servers.
1. Choose Policy > Security Policy > Security Policy.
2. In Security Policy List, click Add, select Add Security Policy, and configure a security policy based on the following parameter values.
  
  Name
  
  policy1
  
  Source Zone
  
  dmz,untrust
  
  Destination Zone
  
  dmz
  
  Destination Address/Region
  
  10.2.0.0/24
  
  Action
  
  Permit
3. Click OK.
Configure a NAT address pool and a NAT policy.
1. Choose Policy > NAT Policy > NAT Policy > Source Translation Address Pool.
2. In Source Translation Address Pool List, click Add and configure a NAT address pool based on the following parameters.
3. Click OK.
4. Choose Policy > NAT Policy > NAT Policy.
5. In NAT Policy List, click Add and configure a NAT policy based on the following parameters.
6. Click OK.
Configure NAT Server. Configure two server mapping entries, one for the web server and the other for the FTP server.
1. Choose Policy > NAT Policy > Server Mapping.
2. Click Add and set the following parameters for a server mapping policy named policy_web used for directing traffic to the web server.
3. Click OK.
4. Repeat the preceding substeps and set the following parameters for another server mapping policy named policy_ftp used for directing traffic to the FTP server.
Enable NAT ALG for FTP.
1. Choose Policy > ASPF Configuration.
2. Select FTP.
Configure a default route on the FW, so that traffic from intranet servers can be forwarded to the ISP router.
1. Choose Network > Route > Static Route.
2. In Static Route List, click Add and configure a default route based on the following parameter values.
  
  Protocol
  
  IPv4
  
  Destination Address/Mask
  
  0.0.0.0/0.0.0.0
  
  Next Hop
  
  1.1.1.254
3. Click OK.
On the router, configure a static route, in which the destination address is 1.1.1.10 and the next-hop address is 1.1.1.1. The router directs traffic destined for 1.1.1.10 to the FW based on the static route so that the FW can forward the traffic to the intranet server.
Contact your ISP administrator to perform this step.

Zone	untrust
IPv4
IP Address	1.1.1.1/24

Zone	dmz
IPv4
IP Address	10.2.0.1/24

Name	policy1
Source Zone	dmz,untrust
Destination Zone	dmz
Destination Address/Region	10.2.0.0/24
Action	Permit

Protocol	IPv4
Destination Address/Mask	0.0.0.0/0.0.0.0
Next Hop	1.1.1.254

Configuration Scripts

Configuration script for the FW:

#
 sysname FW
#
 nat server policy_web protocol tcp global 1.1.1.10 8080 inside 10.2.0.7 www unr-route
 nat server policy_ftp protocol tcp global 1.1.1.10 ftp inside 10.2.0.8 ftp unr-route
#
interface GigabitEthernet0/0/1
 undo shutdown
 ip address 1.1.1.1 255.255.255.0 
#
interface GigabitEthernet0/0/2
 undo shutdown
 ip address 10.2.0.1 255.255.255.0 
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet0/0/1
#
firewall zone dmz
 set priority 50
 add interface GigabitEthernet0/0/2
 detect ftp
# 
firewall interzone dmz untrust 
 detect ftp 
#
 ip route-static 0.0.0.0 0.0.0.0 1.1.1.254 
# 
nat address-group addressgroup1 0
 mode pat
 route enable
 section 0 1.1.1.11 1.1.1.11 
#  
security-policy   
  rule name policy1  
    source-zone dmz 
    source-zone untrust
    destination-zone dmz 
    destination-address 10.2.0.0 24 
    action permit 
#  
nat-policy  
  rule name policy_nat1 
    source-zone dmz 
    destination-zone dmz  
    source-address 10.2.0.6 32
    action source-nat address-group addressgroup1  
# 
return