Newbie - dynamic NAT question

RichThomsonRichThomson
in Firebox - Networking, Multi-Wan, VLAN, NAT, SD-WAN

If I have two internal networks on separate interfaces; 192.168.1.x and 192.168.25.x on an XTM firebox, is there any functional difference or advantage between these two methods of entering the NAT?

192.168.0.0/16

and

192.168.1.0/24
192.168.25.0/24

Comments

  • xxupxxup

    I don't believe so (and the first form is used for exceptions etc), but it is more secure to list only the networks that you are using..

    Adrian from Australia

  • Bruce_BriggsBruce_Briggs

    Absolutely there is a difference if you use those for the interface subnet on devices connected to an interface. /16 will not allow access from devices on 1 interface to devices on the other interface.
    For an SNAT used for incoming access, either should work, but it is always better to use the correct subnet mask, which in your case is /24. Less confusion in the future, and in rare cases there have been issues in various earlier F.ireware versions related to odd/unexpected subnet mask
    For SNAT used for loopback, then /16 may not work for access to the other interface devices - never tried this.

Sign In to comment.