Public IP Placement, in NGAF or assign to server directly ? 5

I've seen request to do nat hairpinning to a server in lan segment. Does anyone have issue doing this type of NAT ? I don't see the application of this type of nat, like what is the point ?

Hi, I'm not familiar with the term "NAT hairpin". Based on google, it was meant for internal IP to access another internal IP for resources or server via the public IP. In Sangfor NGAF/NSD, the term is called Bidirectional NAT. Is that you're trying to configured right now?

HI
NAT hairpinning, also known as NAT loopback, is a network feature that allows internal devices to communicate with a service hosted on the same local network using the public IP or domain name of that service. While this configuration might seem unnecessary at first glance, it has specific use cases that make it practical.

Why Use NAT Hairpinning?
Accessing Services Internally via Public IP/Domain:

Without NAT hairpinning, internal users trying to access a service using its public IP or domain (such as example.com) would fail. This is because the local network doesn't know how to route that traffic properly.
NAT hairpinning allows these internal users to access local resources (e.g., web servers or file servers) by resolving the external public IP back to the internal IP. Essentially, the router "loops" the traffic from internal clients to the internal server through its external interface.
Example Use Case: In a company network where a web server is hosted on the local network, users inside the network can access it using the public domain (e.g., example.com), just like external users. This is helpful when the domain name is hardcoded in applications or browsers for consistency in URLs used by both internal and external users.
Avoiding DNS Issues:

Some DNS setups require consistent domain names both inside and outside the network. Without NAT hairpinning, internal clients would need separate DNS entries (one pointing to the internal IP and another for the public IP). NAT hairpinning simplifies this by allowing internal clients to use the same DNS entry as external users.
Uniform Configuration Across Devices:

With NAT hairpinning, both internal and external users can access the same resources using the same URLs, which reduces complexity in device and application configurations.
Common Issues with NAT Hairpinning
While NAT hairpinning is useful in some scenarios, it can introduce problems, such as:

Performance Overhead: Routing internal traffic through an external interface can add unnecessary overhead compared to accessing the server directly via the LAN. If the router is overloaded or if there are high amounts of internal traffic, this can degrade performance.

Firewall Configuration: Ensuring that your firewall allows this kind of traffic (traffic that originates inside but is looped back in through the external interface) can sometimes be tricky and may require additional configuration.

When Not to Use NAT Hairpinning
For Internal-Only Services: If you are sure that a service is only accessed by internal users, it may be better to use direct internal routing without relying on NAT hairpinning. This is particularly true if performance or simplicity is a concern.
Load Balancing or Reverse Proxy Scenarios: In more complex networks, you might use a load balancer or reverse proxy for internal/external traffic routing. In such cases, hairpinning might be unnecessary since the load balancer can manage traffic redirection efficiently.
Conclusion:
NAT hairpinning has practical applications, especially in environments where internal users need to access services using public domain names or IPs for consistency. However, it introduces some overhead and might not always be necessary, depending on your network configuration and performance requirements.

Public IPs are usually placed on the NGAF for security, allowing it to control traffic before reaching internal servers. NAT hairpinning is used to allow internal devices to access a server via its public IP, but it adds complexity and is mostly useful for specific use cases, like when internal clients must use the same public address as external clients. It can create inefficiencies, and alternative configurations often provide better performance.

Hi, i suggest you to assign always public ip to a firewall like Sangfor NSF (in order to protect your environemnt from external attacks). If you need to call an internal resources at the same way you call it when you're outside your network, you can use dns names. You can define on your internal dns server a public domain (link yourcompany.com) and refefine internally the dns entries for that public domain.On this way you can for example call myserver.yourcompany.com on the same way, regardless you are inside your network or less.