WSM User Guide - WatchGuard Technologies

Using 1-to-1 NATa VPN tunnel is configured when you configure the VPN tunnel and not in the Network > NAT dialogbox.Configuring firewall 1-to-1 NAT1 From Policy Manager, click Network > NAT. Click the 1-to-1 NAT tab.2 Click Add.The 1-1 Mapping dialog box appears.3 In the Map Type drop-down list, select Single IP, IP range, or IP subnet if you want to map to onehost, a range of hosts, or a subnet.4 In the NAT base text box, type the address for the NAT range to see externally.5 Complete all the information. Click OK.6 Repeat steps 2 – 4 for each 1-to-1 NAT entry. When you are done, click OK to close the NAT Setupdialog box. Save the changes to the Firebox.After you configure a global 1-to-1 NAT rule, you must configure the NAT base IP addresses in the appropriatepolicies. In the example given above, we must configure our SMTP policy to allow SMTP trafficfrom Any to 50.1.1.1-50.1.1.5.Configuring policy-based 1-to-1 NATWith this type of NAT, the Firebox uses the private and public IP ranges that you set when you configuredglobal 1-to-1 NAT, but the rules are applied to an individual policy. 1-to-1 NAT is enabled in thedefault configuration of each policy. If traffic matches both 1-to-1 NAT and dynamic NAT policies, the 1-to-1 NAT gets precedence. 1-to-1 NAT will not disable dynamic NAT for the policy.Disabling policy-based 1-to-1 NAT1 From Policy Manager, right-click a policy and select Edit.2 The Edit Policy Properties window appears.3 Click the Advanced tab.4 Clear the 1-to-1 NAT check box to turn NAT off for the traffic this policy controls.5 Click OK. Save the change to the Firebox.118 WatchGuard System Manager