How to clean up your NAT table

08/23/2021 1151 18802

DESCRIPTION:

When encountering network connectivity issues, checking NAT Policies (Network | NAT Policies) of your firewall is an essential step for troubleshooting. In appropriate or wrong NAT policy configuration may cause various connectivity issues. This article aims to discuss the ways of how to clean up your NAT table to prevent the potential network problems.

CAUSE:

• CPU usage spiking close to 100%

RESOLUTION:

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

• The custom NAT policy will be a wrong policy when the policy is too general.
      E.g.: The below policy translated source to LAN Interface IP for any destination IP to any outbound interface. It is a too general policy.

TIP: Make it specific to the outbound interface.

• Wrong NAT policy when do the destination translation for a group with more than one objects. It is a complicated vague policy and is not supported.
      E.g.: The below policy uses an Original Destination of a group named "IN-GROUP" (made of two host objects) and this is not supported.

TIP: For an inbound NAT like this, a one-to-one syntax for Destination is recommended.

• Wrong NAT policy with unassigned interface IP address configured. 
      E.g.: If the interface is unassigned the below policy translates Source IP is X2 IP = 0.0.0.0 as X2 is unassigned.

TIP: Delete this NAT.

• Inappropriate NAT policy when involve the firewall interface in network interactions.
      Eg.: The below policy does source translation in which all sources are translated to the firewall's LAN Interface IP of X0 when packets are forwarded to 190.25.228.161. This is not advisable.

TIP: choose following option 1 or 2:

• Use another available IP address in the X0 Subnet for the translation source of NAT policy.
• Use "Original" for the translation source of this NAT.

• Wrong NAT policy with wrong syntax configured. 
      Eg.: The below policy translated any source to a syntax with a WAN IP address (not firewall WAN IP). It should be a wrong syntax.

TIP: Delete this NAT.

Resolution for SonicOS 6.2 and Below

The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.

• The custom NAT policy will be a wrong policy when the policy is too general.
      E.g.: The below policy translated source to LAN Interface IP for any destination IP to any outbound interface. It is a too general policy.

 TIP: Make it specific to the outbound interface.

• Wrong NAT policy when do the destination translation for a group with more than one objects. It is a complicated vague policy and is not supported.
      E.g.: The below policy uses an Original Destination of a group named "IN-GROUP" (made of two host objects) and this is not supported.

 TIP: For an inbound NAT like this, a one-to-one syntax for Destination is recommended.

• Wrong NAT policy with unassigned interface IP address configured. 
      E.g.: If the interface is unassigned the below policy translates Source IP is X2 IP = 0.0.0.0 as X2 is unassigned.

 TIP: Delete this NAT.

• Inappropriate NAT policy when involve the firewall interface in network interactions.
      Eg.: The below policy does source translation in which all sources are translated to the firewall's LAN Interface IP of X0 when packets are forwarded to 190.25.228.161. This is not advisable.

 TIP: choose following option 1 or 2:

• Use another available IP address in the X0 Subnet for the translation source of NAT policy.
• Use "Original" for the translation source of this NAT.

• Wrong NAT policy with wrong syntax configured. 
      Eg.: The below policy translated any source to a syntax with a WAN IP address (not firewall WAN IP). It should be a wrong syntax.

 TIP: Delete this NAT.