Manual static NAT not advertising MAC

[Keshalia]

Hello,

Any Ideas,

i cant see the virtual Xlated adderss of an internal host from a host on the public side of the gateway (in the same subnet) unless i put in a static arp (on the public host) for the virtual address pointing to the gateways MAC.

i have added the and arp entry to SPLAT using "addarp" but it still seems to not respond to arp requests.

I have also ticked merge proxy arp box but no luck.

im sure this has been asked a few times but i couldnt find anything to help.

Thanks..

[Keshalia]

I got this to work by making the virtual address (Nat address) in a different subnet to the gateways public interface, then pointed a static route on the upstream router to the virtual address via the gateways public address. So no need to ARP the NAT address. Any other host in the external DMZ will use ICMP redirect via the default gateway (upstream router) for a route to the Nat address.

Still a mystery as to why the gateway won’t answer ARP requests for the NAT address if the NAT address is in the same subnet as the gateways external interface?

It works fine with Auto Nat rules :P

[coldark]

You have fixed this problem using a route on the upstream router which forces packets addressed to the Nat address onto the FW Ext I/F. This is fine as long as you have control of the upstream router.

If you want to use the arp method however, in my experience on SPLAT it is not enough to just add the arp entry, you additionally have to put a Static Route on the Firewall which routes the NAT address to the internal next hop (this may be the actual address of the internal box that you are NATting for).

BTW - the reason it works with Automatic Nat rules is that, with Automatic NAT, FW-1 automatically arps - this is not true of manual NAT - check this in the Smart Dashboard GUI - Policy Menu > Global Properties > NAT you will see that there is a check box for automatic arp under Automatic NAT - but it is missing under Manual NAT.