NAT ALG and NAT Server

What it is

NAT ALG (Application Level Gateway) translates IP addresses and ports that a protocol carries inside the payload, not just in the IP header. Without it, protocols such as FTP break as soon as NAT is applied.

NAT Server publishes an inside server on a public address and port. It is the main form of destination NAT on a USG firewall and creates server map entries that the firewall uses to translate incoming traffic.

How it works

Multi-channel protocols

A single-channel protocol, such as HTTP, uses one connection. A multi-channel protocol opens a control channel and then negotiates a second, data channel whose address and port are written in the control messages.

Two problems follow. The security policy has no rule for the dynamic data channel, and after NAT the address in the payload is the private one, which the outside peer cannot reach.

ASPF and NAT ALG

ASPF (Application Specific Packet Filter) inspects the application layer of the control channel. It learns the negotiated data channel and creates a temporary server map entry, so the data connection is allowed without opening a wide rule.

NAT ALG works with ASPF. When NAT is applied, it replaces the private address and port in the payload with the translated public ones, so the peer connects to an address that works.

Both are enabled per protocol with the detect command, globally or between two zones:

firewall detect ftp
#
firewall interzone trust untrust
 detect ftp

The server map

The server map is a table of mappings, separate from the session table. When a first packet matches no session, the firewall checks the server map, translates if needed, and creates a session.

A server map entry is not a session. Use display firewall server-map for the mappings and display firewall session table for live connections.

Configuring NAT Server

nat server web protocol tcp global 202.1.1.5 www inside 10.2.0.7 8080
nat server mail global 202.1.1.6 inside 10.2.0.8

The first line maps TCP port 80 (www) on 202.1.1.5 to port 8080 on 10.2.0.7, a port based mapping. The second maps every port of 202.1.1.6 to 10.2.0.8, an address based mapping that publishes the whole server.

NAT Server creates two static server map entries. The forward entry translates incoming traffic from the public to the private address. The reverse entry lets the server start connections to the internet with the public address as its source. The no-reverse keyword creates only the forward entry.

A security policy from Untrust to DMZ must still permit the traffic, using the private server address, and the public address should have a blackhole route to prevent loops.

A worked example

Users in the Trust zone use Easy IP to reach an FTP server on the internet in active mode. The data connection fails: the client logs in, but directory listings never arrive.

The PORT command still carries the private client address, and no rule permits the server's data connection. After firewall detect ftp, NAT ALG rewrites the PORT command with the public address, ASPF creates a server map entry for the data channel, and the listing works.

How the exam asks about this

• "Which feature translates addresses carried in the FTP payload?" -> NAT ALG.
• "Which table holds the entry that lets the negotiated FTP data channel through?" -> The server map, with an ASPF entry.
• "What does the reverse server map entry created by NAT Server allow?" -> The inside server can start outbound connections using its public address.