We recently done a network intra upgrade by adding an additional firewall as the 1st tier firewall, and making the current one 2nd tier. The setup is:

WAN <--> 1st Tier Firewall <--> Intermediate LAN <--> 2nd Tier Firewall <--> Internal LAN

There's other network such as DMZ, Wifi guest and so on which is not shown above. The intermediate LAN is only a single connection between the 2 firewall, no server or workstation connected to it. The IP for the above network is:

Intermediate LAN : 192.168.100.x/24

Internal LAN : 192.168.50.x/24(Server Farm) & 192.168.40.x/24(Workstation)

We've setup policies to enable browsing and various web traffic from Server Farm and Workstation to WAN. Web filtering is done on 1st tier firewall.

Now the problem we're facing is that, we need to turn on NAT on both the 1st and 2nd tier firewall in order to make web browsing works. If we turn off NAT for the 2nd tier, we're able to ping external IP (ISP DNS, Google DNS), but domain name will not resolve, and thus no web browsing. When we check the log on the 1st tier firewall, DNS packet has indeed allowed to pass through, but workstation and server still failed to resolved domain name.

Since the 1st tier firewall is doing the web filtering, we would like the executive report or any log to show the originating workstation IP instead of the IP of the 2nd tier firewall if NAT is turned on. We also like to reduce the load on the 2nd tier firewall by not having the NAT on it.

What do we need to change to make it work with just 1 layer of NAT?

EDIT: Sorry of the confusion, basically we just want to know generic solutions to the above problem, like adding the server/workstation network address to the 1st tier interface, or having specific static route in the 2nd tier, or did we're not suppose to have an intermediate LAN and so on. We believe there's no specific configuration which only works on certain brand of firewall

EDIT: 1st tier is Astaro and 2nd tier is FortiGate. There's 3 vlan configured on the LAN port of Fortigate, with Server as native and workstations and printers in 2 separate vlan. For now we're focusing on Server only. There's a policy to allow all traffic from Server to Astaro's LAN port. NAT is enabled on this policy. On Astaro, there's 2 policies allowing LAN to WAN for DNS and HTTP. Browsing works. But if the Server->Astaro policy's NAT is off, we cannot resolve external domain name on server. We can always ping external IPs such as or ISP's DNS regardless of the NAT.

  • 1
    What kind of routers are these? – EEAA Feb 17 '12 at 1:48
  • Firewall applicance, with at least 5Gbps throughput on firewall policies. The setup and configuration is not brand specific. – faulty Feb 17 '12 at 2:09
  • 1
    If you want good answers, @faulty, you need to provide specific details. You're asking us "how to configure...", but you're not telling us what we're configuring. – EEAA Feb 17 '12 at 2:14

Well, you've given us zero details on the equipment in question, so this answer is going to be very generic.

Your outside firewall is doing NAT. The inside firewall needs to both ACLs configured such that your desired packets can pass back and forth as well as having proper routes added so it knows which interfaces to route traffic to.

  • We already have the ACL in place, or else we won't be able to access WAN from inside. But the problem only comes if we disable NAT on the inside. – faulty Feb 17 '12 at 2:28
  • Well something is still clearly wrong. Provide more information and you'll have a chance at getting a helpful answer. – EEAA Feb 17 '12 at 3:54
  • What other info do you require? – faulty Feb 17 '12 at 5:39
  • As above, details of your equipment and relevant configuration snippets. Also, what troubleshooting steps you've taken. – EEAA Feb 17 '12 at 5:42
  • 1
    Please post that as part of your answer so people don't miss these details. – EEAA Feb 17 '12 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.