- Table of Contents
-
- 08-Configuration Examples
- 01-Web Login Configuration Examples
- 02-Internet Access Through a Static IP Address Configuration Examples
- 03-Internet access through PPPoE configuration examples
- 04-Signature Library Upgrade Configuration Examples
- 04-Software Upgrade Examples(only for F50X0-D and F5000-AK5X5 firewalls)
- 05-Software Upgrade Examples
- 06-Static routing configuration examples
- 07-OSPF configuration examples
- 08-BGP configuration examples
- 09-RIP configuration examples
- 10-DHCP configuration examples
- 11-DNS configuration examples
- 12-Object Group Configuration Examples
- 13-Public key management configuration examples
- 14-Security Policy Configuration Examples
- 15-Attack defense configuration examples
- 16-Connection Limit Configuration Examples
- 17-IPS Configuration Examples
- 18-URL Filtering Configuration Examples
- 19-Anti-Virus Configuration Examples
- 20-Data Filtering Configuration Examples
- 21-File Filtering Configuration Examples
- 22-APR-Based Security Policy Configuration Examples
- 23-Bandwidth Management Configuration Examples
- 24-NAT configuration examples
- 25-NAT hairpin configuration examples
- 26-IPsec configuration examples
- 27-SSL VPN configuration examples
- 28-Server Load Balancing Configuration Examples
- 29-Outbound Link Load Balancing Configuration Examples
- 30-Inbound Link Load Balancing Configuration Examples
- 31-Transparent DNS Proxy Configuration Examples
- 32-Context Configuration Examples
- 32-Context Configuration Examples(only for F50X0-D and F5000-AK5X5 firewalls)
- 33-IRF configuration examples
- 34-High Availability Group Configuration Examples
- 35-NAT Flow Logging Configuration Examples
- 36-User identification configuration examples
- 37-Server Connection Detection Configuration Examples
- 38-IP Reputation Configuration Examples
- 39-NPTv6 Configuration Examples
- 40-SSL Decryption Configuration Examples
- 41-MAC Address Learning Through a Layer 3 Device Configuration Examples
- 42-WAF Configuration Examples
- 43-NetShare Control Configuration Examples
- 44-4G Configuration Examples
- 45-WLAN Configuration Examples
- Related Documents
-
Title | Size | Download |
---|---|---|
35-NAT Flow Logging Configuration Examples | 125.73 KB |
NAT flow logging configuration examples
Introduction
The following information provides NAT flow logging configuration examples.
This document is not restricted to specific software or hardware versions. Procedures and information in the examples might be slightly different depending on the software or hardware version of the device.
The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.
The following information is provided based on the assumption that you have basic knowledge of flow logging, NAT logging, and NAT.
Network configuration
As shown in Figure 1, configure NAT flow logging on the device to enable it to send NAT session information to the log server for user tracing and analysis. The following log information is recorded when the internal host accesses the server on the public network: Source IP address, source port number, destination IP address, and destination port number before and after NAT translation.
Software versions used
This configuration example was created and verified on F9345 of the F1060 device.
Restrictions and guidelines
· To record IP address and port number after translation, use log version 3.0.
· For the NAT flow logging to take effect, you must enable NAT logging.
· Logs cannot be sent to the log host and the information center at the same time. By default, logs are sent to the log host. If the information center is specified as the log output destination, logs will not be sent to the log host.
Procedure
Configuring the device
1. Assign IP addresses to interfaces and add the interfaces to security zones.
# On the top navigation bar, click Network.
# From the navigation pane, select Interface Configuration > Interfaces.
# Click the Edit icon for GE 1/0/0.
# In the dialog box that opens, configure the interface:
a. Select the DMZ security zone.
b. On the IPv4 Address tab, enter the IP address and mask of the interface. In this example, enter 192.168.100.200/24.
c. Click OK.
# Add GE 1/0/1 to the Trust security zone and set its IP address to 172.16.1.254/24 in the same way you configure GE 1/0/0.
# Add GE 1/0/2 to the Untrust security zone and set its IP address to 202.2.2.1/24 in the same way you configure GE 1/0/0.
2. Create security policy SecPolicy1.
# On the top navigation bar, click Policies.
# From the navigation pane, select Security Policies > Security Policies.
# Click Create and click Create a policy.
# In the dialog box that opens, configure a security policy:
¡ Enter policy name SecPolicy1.
¡ Select source zone Trust.
¡ Select destination zone Untrust.
¡ Select IPv4 as the type.
¡ Select action Permit.
¡ Specify 172.16.1.0/24 as the source address.
¡ Specify 202.2.2.0/24 as the destination address.
# Click OK.
3. Create security policy SecPolicy2.
# On the top navigation bar, click Policies.
# From the navigation pane, select Security Policies > Security Policies.
# Click Create.
# In the dialog box that opens, configure a security policy:
¡ Enter policy name SecPolicy2.
¡ Select source zone Local.
¡ Select IPv4 as the type.
¡ Select destination zone DMZ.
¡ Select action Permit.
¡ Specify 192.168.100.0/24 as the destination address.
# Click OK.
4. Configure NAT.
# On the top navigation bar, click Policies.
# From the navigation pane, select NAT > Static NAT > Policy Configuration.
# Click Create.
# Create an outbound static NAT mapping, as shown in Figure 2.
Figure 2 Creating an outbound static NAT mapping
# Click OK.
# On the top navigation bar, click Policies.
# From the navigation pane, select NAT > Static NAT > Apply Policy.
# Select GE 1/0/2 and click Enable. The mapping has been applied to the interface, as shown in Figure 3.
Figure 3 Applying the static NAT mapping
5. Configure flow logging.
# On the top navigation bar, click System.
# From the navigation pane, select Log Settings > Basic Settings.
# On the Flow Log tab, configure flow logging, as shown in Figure 4.
Figure 4 Configure flow logging
6. Configure NAT logging.
# On the top navigation bar, click System.
# From the navigation pane, select Log Settings > NAT Log Settings.
# Configure NAT logging, as shown in Figure 5.
Figure 5 Configure NAT logging
# Click Apply.
Configuring the log server
# Configure the log server. (Details not shown.)
Verifying the configuration
Verify that a NAT session log is generated on the log server when the host accesses the server on the public network. The log information includes source IP address, source port number, destination IP address, and destination port number before and after translation.