Configure NAT exemption

NAT exemption allows certain addresses to bypass NAT translation, so both your internal and external hosts can initiate connections with protected hosts.

Unlike identity NAT, which does not restrict translation to specific interfaces, you must apply NAT exemption across all interfaces. NAT exemption lets you specify both real and destination addresses, similar to policy NAT. To control access by port, use static identity NAT with an access list.

For remote access VPN, configure static identity NAT with the route lookup option. Without this option, the Firewall Threat Defense device sends traffic through the interface defined in the NAT rule and ignores the routing table. Misrouting can cause problems, such as DHCP traffic not returning correctly. The route lookup option ensures that the device uses the proper interface based on the routing table, to maintain correct traffic flow for VPN and internal hosts.

Before you begin

Verify if NAT is enabled on the devices with remote access VPN policies. If NAT is enabled, create a NAT exemption policy for the VPN traffic.

Procedure

Step 1

Choose Policies > Network policies > NAT.

Step 2

Edit a NAT policy or click New Policy > Threat Defense NAT to create a NAT policy with a NAT rule to allow connections through all interfaces.

Step 3

Click Add Rule to add a NAT rule.

Step 4

In the Add NAT Rule dialog box, configure these parameters:

  1. From the NAT Rule drop-down list, choose Manual NAT Rule.

  2. From the Type drop-down list, choose Static.

  3. Click the Interface Objects tab, and select the source and destination interface objects.

Note

This interface object must match the interface specified in the remote access VPN policy.

  1. Click the Translation tab.

    • From the Original Source and Translated Source drop-down lists, choose the source networks.

    • From the Original Destination and Translated Destination drop-down lists, choose the destination networks.

Step 5

Click the Advanced tab.

Step 6

Check the Do not proxy ARP on Destination Interface check box.

This option disables proxy ARP for incoming packets to mapped IP addresses. By default, the system uses proxy ARP to respond to ARP requests for mapped addresses on the same network, simplifying routing since no extra gateway is needed. If you disable proxy ARP, ensure the upstream router has correct routes to those addresses.

Step 7

Click OK.