Partner Certification Training - IAM Associate

Firewall

Sangfor CTI
tech.support@sangfor.com
April 2017
www.sangfor.com
 Firewall Introduction

SNAT
SANGFOR
IAM
DNAT

深信服公司简介
Practice
Introduction
1. Firewall rules
The [Firewall Rules] page enables you to
configure such filtering conditions as destination
protocol and port, source IP address, destination
IP address and time schedule to filter the data Firewall rule

forwarding among the network interfaces on IAM

device. HTTP HTTPS

In version IAM 11.0 and above, SNAT & DNAT

will be configured in route mode deployment.
Firewall Rules
Configuration
SNAT Introduction
2. SNAT
[SNAT] enables you to set Source Network
IP4
Address Translation (SNAT) rules, which
SNAT
converts source IP addresses of corresponding
packets forwarded by IAM device. It is
typically used when IAM device is deployed as
route mode. The device proxies the LAN users
to access Internet and therefore the IP1
corresponding SNAT rules should be
configured.
DNAT Introduction
IP4
3. DNAT

[DNAT] enables you to set Destination

Network Address Translation (DNAT)
rules, which converts destination IP
addresses of the packets going through DNAT
IP2
IAM device. Typical usage includes
releasing server, mapping services
provided by LAN servers to public
network or providing access to Internet IP4

users.
SNAT Case Study
SNAT Case Study
A customer’s topology is as shown on the right.
SANGFOR IAM equipment is deployed as
route mode to realize SNAT and perform
Internet access control.

Within a factory, computers with internet

access are all in 192.200.1.0/24 network
segment while servers are in 192.200.2.0/24
network segment.
SNAT Case Study
Configuration Steps：

Static Route

IAM must be configured with static routes such as:

192.200.1.0 255.255.255.0 172.16.1.1
192.200.2.0 255.255.255.0 172.16.1.1
SNAT Case Study
2. SNAT Configuration
SNAT Case Study
SNAT (Configuration Wizard)
DNAT Case Study
DNAT Case Study
Requirement

OA server’s IP address is 192.200.2.250

and it is using TCP port 80.

Customer wants to publish this OA server

to public network, extranet and intranet
users. Users can access the OA server by
http://202.96.137.75:8000
DNAT Case Study
Configuration Steps：

1. DNAT RULE: DST IP 202.96.137.75,DST TCP PORT 8000 translate to

DST IP 192.200.2.250，DST TCP PORT 80

2. Bypass firewall

3. Release server(LAN user can access LAN server using WAN IP)
DNAT Case Study
Configuration：
DNAT Case Study
Precautions：

1. Bypass firewall: Specify whether to bypass firewall rules automatically.

We recommend to check this option.

2. Release server: Check this option when LAN users need to access server
on the same subnet as their location through a public IP address. The purpose
is to translate LAN users‘ source addresses access packets to the IP address of
the specified interface to avoid situation that LAN users cannot establish the
connection with the server when accessing public IP. When this option is
checked, IAM device will automatically create a SNAT rule to translate the
source IP address.
Practice
A customer network topology is as
shown. There is a mail server IP
address, 172.100.1.2 and mail server
domain is mail.sangfor.com, binding
two wan ip address.

Requirement : Internet and Intranet

users can sent and receive mail by
using mail.sangfor.com
 Question

1. What is the function of SNAT?

2. What is the function of DNAT?

3. Under what circumstances do we need to check "release

server" option?
www.sangfor.com

Sangfor Technologies (Headquarters)

Block A1, Nanshan iPark, No.1001
Xueyuan Road, Nanshan District,
Shenzhen, Guangdong Province,
P. R. China (518055)