PAT

[sphinx]

Folks, i have a single Public address that i need to run SSH and FTP through i know that i have to use PAT to do this but when i am setting up this rule under the NAT tab do i have to set the destination to the gateway or the server itself.

[cephalon]

I believe that you could probably use the gateway as the destination, but I prefer to create a Hide-NAT object with the same IP address as the Gateway's external interface. Personal preference, I suppose.

My rule would look something like this.


Orig Src=Any
Orig Dst=Hide-Nat-Gateway-Object
Orig Srv=SSH
Xlate Src=Original
Xlate Dst=SSH Server
Xlate Srv=Original

Same thing can be done with FTP.

[RobertGraham]

It sounds like you have incoming services that need to hide behind one single external IP.

In the old NG(I can't believe it's old now) you had to use the mapped services. These are named like smtp_mapped and you had to include them in the security policy as well. There should be an old article explaining this lying around here somewhere.

They may have improved on this in NGX, you didn't post what version so it's guesswork. If the straightforward method doesn't seem to work, try the mapped services and see how you do.