Configure Identity Manual NAT

Use static identity manual NAT rules when auto NAT does not meet your needs. For example, if you want to do different translations based on the destination. Use static identity NAT rules to prevent the translation of an address. That is, to translate the address to itself.

Before you begin

Select Objects > Object Management and create the network objects or groups needed in the rule. Groups cannot contain both IPv4 and IPv6 addresses; they must contain one type only. Alternatively, you can create the objects while defining the NAT rule. The objects must also meet the following requirements:

Original Source—This can be a network object or group, and it can contain a host, range, or subnet. If you want to translate all original source traffic, you can skip this step and specify Any in the rule.
Translated Source—The same object or group as the original source. Optionally, you can select a different object that has the exact same contents.

You can also create network objects or groups for the Original Destination and Translated Destination if you are configuring a static translation for those addresses in the rule. If you want to configure destination static interface NAT with port translation only, you can skip adding an object for the destination mapped addresses and specify the interface in the rule.

You can also perform port translation on the source, destination, or both. In the Object Manager, ensure that there are port objects you can use for the original and translated ports. You can use the same object for identity NAT.

Procedure

Step 1	Select Devices > NAT and create or edit the threat defense NAT policy.
Step 2	Do one of the following: Click the Add Rule button to create a new rule. Click Edit () to edit an existing rule. The right click menu also has options to cut, copy, paste, insert, and delete rules.
Step 3	Configure the basic rule options: NAT Rule—Select Manual NAT Rule. Type—Select Static. This setting only applies to the source address. If you define a translation for the destination address, the translation is always static. Enable—Whether you want the rule to be active. You can later activate or deactivate the rule using the right-click menu on the rules page. Insert—Where you want to add the rule. You can insert it in a category (before or after auto NAT rules), or above or below the rule number you specify.
Step 4	On Interface Objects, configure the following options: Source Interface Objects, Destination Interface Objects—(Required for bridge group member interfaces.) The interface objects (security zones or interface groups) that identify the interfaces where this NAT rule applies. Source is the object containing the real interface, the one through which the traffic enters the device. Destination is the object containing the mapped interface, the one through which traffic exits the device. By default, the rule applies to all interfaces (Any) except for bridge group member interfaces.
Step 5	Identify the original packet addresses, either IPv4 or IPv6; namely, the packet addresses as they appear in the original packet. See the following figure for an example of the original packet vs. the translated packet where you perform identity NAT on the inside host but translate the outside host. Original Source—The network object or group that contains the addresses you are translating. Original Destination—(Optional.) The network object or group that contains the addresses of the destinations. If you leave this blank, the source address translation applies regardless of destination. If you do specify the destination address, you can configure a static translation for that address or just use identity NAT for it. You can select Interface Object to base the original destination on the source interface (which cannot be Any). If you select this option, you must also select a translated destination object. To implement a static interface NAT with port translation for the destination addresses, select this option and also select the appropriate port objects for the destination ports.
Step 6	Identify the translated packet addresses, either IPv4 or IPv6; namely, the packet addresses as they appear on the destination interface network. You can translate between IPv4 and IPv6 if desired. Translated Source—The same object or group as the original source. Optionally, you can select a different object that has the exact same contents. Translated Destination—(Optional.) The network object or group that contains the destination addresses used in the translated packet. If you selected an object for Original Destination, you can set up identity NAT (that is, no translation) by selecting the same object.
Step 7	(Optional.) Identify the source or destination service ports for service translation. If you are configuring static NAT with port translation, you can translate ports for the source, destination, or both. For example, you can translate between TCP/80 and TCP/8080. NAT only supports TCP or UDP. When translating a port, be sure the protocols in the real and mapped service objects are identical (both TCP or both UDP). For identity NAT, you can use the same service object for both the real and mapped ports. Original Source Port, Translated Source Port—Defines a port translation for the source address. Original Destination Port, Translated Destination Port—Defines a port translation for the destination address.
Step 8	(Optional.) On Advanced, select the desired options: Translate DNS replies that match this rule—Do not configure this option for identity NAT. IPv6—Whether to use the IPv6 address of the destination interface for interface PAT. Do not proxy ARP on Destination Interface—Disables proxy ARP for incoming packets to the mapped IP addresses. If you use addresses on the same network as the mapped interface, the system uses proxy ARP to answer any ARP requests for the mapped addresses, thus intercepting traffic destined for a mapped address. This solution simplifies routing because the device does not have to be the gateway for any additional networks. You can disable proxy ARP if desired, in which case you need to be sure to have proper routes on the upstream router. Normally for identity NAT, proxy ARP is not required, and in some cases can cause connectivity issues. Perform Route Lookup for Destination Interface— If you select source and destination interfaces when selecting the same object for original and translated source address, you can select this option to have the system determine the destination interface based on the routing table rather than using the destination interface configured in the NAT rule. Unidirectional—Select this option to prevent the destination addresses from initiating traffic to the source addresses. The unidirectional option is mainly useful for testing purposes and might not work with all protocols. For example, SIP requires protocol inspection to translate SIP headers using NAT, but this will not occur if you make the translation unidirectional.
Step 9	Click Save to add the rule.
Step 10	Click Save on the NAT page to save your changes.