WatchGuard Firebox System 7.0 User Guide

Chapter 7: Configuring Network Address TranslationAdding simple dynamic NAT entriesUsing built-in host aliases, you can quickly configure theFirebox to masquerade addresses from your trusted andoptional networks. If trusted hosts are already covered bythe default, non-routable ranges, no additional entries areneeded:• From: Trusted• To: ExternalThe default dynamic entries are listed in the previous section.Larger or more sophisticated networks may require additionalentries in the From or To lists of hosts or host aliases.The Firebox applies dynamic NAT rules in the order inwhich they appear in the Dynamic NAT Entries list. Watch-Guard recommends prioritizing entries based on the volumeof traffic that each represents. From the NAT Setupdialog box:1 Click Add.2 Use the From drop-down list to select the origin of theoutgoing packets.For example, use the trusted host alias to globally enable networkaddress translation from the Trusted network. For a definition ofbuilt-in Firebox aliases, see “Using Aliases” on page 162. Formore information on how to add a user-defined host alias, see“Adding an alias” on page 163.104 WatchGuard Firebox System