We have multiple public IP address subnets for various purposes. I need to create an Internal Zone behind NAT that presents itself as having an external IP in External Zone B.
[UNTRUST] [TRUST] ISP---<---External Zone A ---<--- Internal Zone C (Public IPs) nat (Private IPs) | routed ^ | External Zone B ---<--- Internal Zone D (Public IPs) nat (Private IPs)
Putting a DIP pool on Zone B would seem like a logical step but then how do I construct the routing so that the Policy from D to A will be relevant to traffic going out via the ISP?
Is this even possible? I know I could do this with a second firewall between D and B, as this the ssg would happily route traffic with a source in B to the ISP but I am not sure I can get a NAT from D to B, then a route from B to A and out.
(A, B and C all work and route correctly today, currently C&D presents as the egress IP of zone A, I would happily accept a solution where D presents as the IP of the interface in Zone B)
Hardware: SSG320M Software: 6.3.0r21.0