Regarding Hide NAT(PAT)

Unanswered Question
Jan 2nd, 2009

Dear Team,

Whether doing Hide NAT(Hide behind IP or Hide behind Gateway) will automatically add two rules in the rulebase.

For example If someone from internal network want to access external public IP

Internal Network 10.10.10.1/24

External IP:- 1.1.1.1(Public IP)

NAT IP:- 2.2.2.2

Now when the internal network accesses the public IP it will get Hide NATed to the public IP 2.2.2.2--

Will that mean the one more rulebase will get created automatically(because of Hide NAT) which will mean that the external IP (1.1.1.1) can access 2.2.2.2 and then this 2.2.2.2 IP will get NATed to 10.10.10.1

Am I correct?

If yes then will that mean that at a time either internal network can access external IP OR external IP can access internal network.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
cisco24x7 Fri, 01/02/2009 - 06:17

With Checkpoint:

NAT is independent with security rules. You

need to define both "hide" NAT and add security

rules for inside to get to outside. Most

security folks prefer it this way. Always

deny unless explicitly allow.

With Cisco:

by default, inside is allowed to traverse to

outside unless explicitly deny. This is very

insecure.

Either way, with Cisco, once you define

PAT/NAT, inside hosts can communicate

with outside hosts, by default, unless

explicitly denies.

Easy right?

Actions

This Discussion