Translate Internal Client IP Addresses to Your Public IP
Address (Source DIPP NAT)
When a client on your internal network sends
a request, the source address in the packet contains the IP address
for the client on your internal network. If you use private IP address
ranges internally, the packets from the client will not be able
to be routed on the Internet unless you translate the source IP
address in the packets leaving the network into a publicly routable
On the firewall you can do this by configuring a
source NAT policy that translates the source address (and optionally
the port) into a public address. One way to do this is to translate
the source address for all packets to the egress interface on your
firewall, as shown in the following procedure.
Create an address object for the external IP address
you plan to use.
for the object.
and then enter the IP address of the external interface on the firewall,
203.0.113.100 in this example.
Although you do not have to use
address objects in your policies, it is a best practice because
it simplifies administration by allowing you to make updates in
one place rather than having to update every policy where the address
Create the NAT policy.
tab, enter a
for the policy.
) Enter a tag, which is a keyword
or phrase that allows you to sort or filter policies.
select the zone you created for your internal network in the
select the zone) and the zone you created for the external network
Dynamic IP And Port
drop-down in the Source Address Translation section
of the screen.
, there are
two choices. You could select
. Select the address object
you just created.
, in which case the translated address will be
the IP address of the interface. For this choice, you would select
and optionally an
if the interface has more than one IP address.
Commit your changes.
) Access the CLI to verify the translation.
show session all
to view the session table, where you can verify the source IP address
and port and the corresponding translated IP address and port.
show session id <id_number>
view more details about a session.
If you configured Dynamic IP NAT, use the
show counter global filter aspect session severity drop | match nat
to see if any sessions failed due to NAT IP allocation. If all of
the addresses in the Dynamic IP NAT pool are allocated when a new
connection is supposed to be translated, the packet will be dropped.