In this video I'll be walking through the process of setting up source NAT on
a Sophos XG firewall. Before we start let's take a quick look at a common
scenario where source NAT would be used. Consider an administrator needing to ensure
that all LAN traffic destined for the WAN is masked. They can do this by
setting up a Source NAT policy on the XG firewall to mask the traffic with
a predefined IP address. Let's take a look at how to do this on the extra
firewall now start off by logging into the XG firewall administration portal.
Next we'll create an alias interface by navigating to Network > Interfaces.
Here click on add interface, and then we'll
select Add Alias from the drop-down menu. On the Add Alias screen we'll select our
WAN port, port 2 as our physical interface, we'll leave ipv4 selected as
our IP version, and then we'll specify an IP address which will be the additional
alias address for the WAN Interface. As well as a corresponding net mask.
Once that's all completed we'll click Save. On the following screen we'll see
our newly created alias interface showing under our port 2 WAN interface
as an IP address. Next we'll move on to creating an IP host. To do this, navigate
to Hosts and Services > IP Host. From here we'll click Add to add an
additional IP host. Here we'll specify an IP hostname. We'll
select ipv4 is our IP version, type will be IP we'll specify our IP address, and if
required we can even specify an IP host group. In this case we'll leave it blank.
Once we filled everything out we'll simply click Save to save our settings
and our IP host will be created. Now that we've created an alias interface as well
as an IP host we'll need to add a NAT policy. To do this go to Profiles and
Network Address Translation. From here click Add to add a new NAT policy we'll
call our NAT policy Source NAT, and as the IP address we'll select s NAT IP,
which is the IP host that we created in the previous step. Then we'll simply
click Save to save our NAT policy. Next we'll need to create a firewall rule and
to do this will navigate to Firewall. From this page we'll click on Add
Firewall Rule in the top right corner and we'll select User or Network Rule.
Here we'll start off by specifying a name for our firewall rule,
and then we'll specify the Source Zone which is LAN, as well as the Destination
Zone which in this case is WAN.
In this scenario we're trying to reach an external web server so for the
Destination Networks we're going to select External Web Server.
Moving on under NAT and Routing, > Use Outbound Address,
we'll select Source NAT. This is the NAT policy that we created in an earlier
step next we'll click Save
and our firewall rule has now successfully been created. In this
demonstration we created an alias WAN interface, we specified it as an IP host,
we created a corresponding NAT policy, and then we applied that NAT policy in a
newly created firewall rule.