Dynamic NAT with multiple external public addresses

ERR

Hello,

I am new with Zyxel. I am trying to setup an USG20-VPN to replace an existing setup made like this:

ISP give the customer different public IP address (i.e. 8.0.0.1 - 8.0.0.6). The internal network is a single local subnet (i.e. 10.0.0.0/16).

The firewall is using 8.0.0.1 on the WAN port.

What I am trying to achieve is to use two public IP addresses used to NAT the local network. These public addresses are different from the WAN port address (i.e. are 8.0.0.2 and 8.0.0.3).

I have created two virtual WAN interfaces with 8.0.0.2 and 8.0.0.3 ; then I defined a IP RANGE object with these two adresses.

On the Network -> NAT area I have tried to create a "Many 1:1 NAT" with the external object and the LAN1_SUBNET internal net, but the I have the following error displayed "Warning Message: 'The IP Configuration is invalid. Please check the Original IP and Mapped IP.'".

I am unsure this is the correct way to do it. And that it is possible to do it with the USG20-VPN.

Any help is welcome.

Regards

[Deleted User]

Hello @ERR and welcome to the forum!

I guess you want that specific internal IPs or subnets should use a specific WAN IP when going out into the internet?

Then please follow this guide here from page 4 on ("SNAT Routing):

https://onesecurity.zyxel.com/img/uploads/Policy_Routing_Walkthrough.pdf

Virtual WAN interfaces and "Many 1:1 NAT" rules are not needed and you can remove them.

I hope this helps!

Best regards

Lukas

ERR

Hello Lukas,

No, I don't want to set the internal IP or subnet to use a specific WAN IP.

The internal subnet is only one (10.0.0.0/24), and the external are multiple WAN IP addresses, that are allocated dinamically. Moreover the WAN IP addresses to be used for NAT are different from the one used for the firewall.

I had already looked to that document but I believe it is not my case.

Thank you

Zyxel_Jerry

Hi @ERR

I think you don’t need Many 1:1 NAT in certain purpose.

In your scenario, you need more physical wan interface to be configured on your device since virtual interfaces may not fulfill this kind of requirement.

Since USG20-VPN has only 1 WAN port, we’ll suggest to use model USG110 instead to support multiple WAN interfaces.

For more spec information about USG110, you can refer to the datasheet below:

ftp://ftp2.zyxel.com/USG110/datasheet/USG110_14.pdf

With multiple WAN IP addresses, WAN trunk with policy route setting can allow a range of IP address to go out through the WAN trunk interface.

Here is the reference about how to set up WAN trunk, you may check if this feature can fulfill your requirement.

https://kb.zyxel.com/KB/searchArticle!gwsViewDetail.action?articleOid=015529&lang=EN