#Configuration# How to Configure DNAT for Sangfor NGAF V8.0.85?

*1. Introduction

1.1 User Scenario
Sangfor DNAT (Destination Network Address Translation) is a feature provided in Sangfor’s IAM (Internet Access Management) and NGFW (Next-Generation Firewall) products. DNAT is a technique used in network routing that allows a firewall or router to translate a destination IP address to another destination IP address.

Here are some key points about Sangfor DNAT:

• It’s used to redirect incoming traffic to a specific internal host or server.
• It’s often used to allow external devices to access services on internal networks.
• It can be configured through the Sangfor IAM(route mode) or NGFW interface.
• The configuration involves specifying the original destination IP and port, and the translated destination IP and port.
• It’s useful for situations where you want to expose a service, application, or server on your local network to users on the internet.

  
  
  
  

Now in this guide, we’ll see the steps required to publish an internal resource.

1.2 Requirements
1. Firewall Sangfor NGAF updated to the latest release
2. IP address and port used by your network resource that you want to allow external access.

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

*2. Configuration Guide
In this guide, we will have the 10.0.0.0/24 network segment and we want to publish an internal web server with ip 10.0.0.5 that has an apache2 listening on port 20443.

2.1 NGAF DNAT Configuration
Step 1. Recheck your zones and configure address objects on NGAF.
To do that, we need to go to this NGAF section:

In this example we have:
Src Zone: L3_WAN (our wan)
Public IP: UTGNET (our provider)
Local webserver ip: PHPIPAM (our webserver that we want to publish)

Step 2. Create a custom service object as we need to use 20443 port.

To do so we need to go to this NGAF section:

In our example, I created a Custom Service named IPAM_20443


Step 3. Create a DNAT object.


Select Destination NAT using the objects created before.
The Destination > Network Object is the network object configured with the public IP that is configured on the NGAF device.
Here you can see that I’m not using a different internal port, so I left blank the field Translate Port to.

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

2.2 NGAF policy configuration

Step 1. In the last step, if you select Add ACL Policy manually, you are redirected to the application policy section of NGAF. I prefer to create manually on this NGAF section:

In our example, I create an application control rule as follows:


<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

*3. Precaution
When you create your custom service object, it’s important to specify 0-65535 as the source port as you can’t know which port is used when external users try to access this resource.

This article is written by Enrico Vanzetto who is a technical engineer and has much experience and a better understanding of Sangfor network secure (NGAF), HCI, Endpoint Secure, VDI, and Cyber Command products. If you want to know more about him, click here.

Thanks for sharing

Thanks for sharing.