0

Is it possible to see the NAT or PAT mapping from the firewall logs? For example a Fortigate.

Thank you

This is my previous question which I cannot edit. But here I am posting a precise question. Where does network address translation happen in a dual firewall architecture?

Improve this question
2
  • 1
    The NAT or NAPT (PAT is a vendor specific term for NAPT) translation tables are in the device, not the logs. You should be able to show the translation table using commands in the device, but the commands to do that depend on the device model. Remember that NAT/NAPT is a different function and process than firewall (you can firewall or route just fine without using NAT/NAPT), so it has separate tables.
    – Ron Maupin ♦
    Sep 17, 2019 at 13:46
  • @RonMaupin I see. As I am using Splunk I thought that maybe I could correlate logs from the back-end firewall and the Reverse Proxy. I guess I will try something different.
    – Aizzaac
    Sep 17, 2019 at 13:58

2 Answers 2

Reset to default
2

From firewall log, you can check the NAT IP (public IP) for a packet and the source port being used. In fortigate, go to Log & Report > Forward Traffic > Double click on any log to open a log detail window. Here in source section , you will find the NAT IP and source port as well as other details for the packet.

Improve this answer
1
  • It is possible. The only problem is that the type of NAT is dynamic. So it will be too much work to follow up with the correlation
    – Aizzaac
    Sep 17, 2019 at 16:12
0

Yes ! Firewall traffic logs provides the information required . From firewall logs contains information like ..

Souce IP address

Souce NAT address

Destination IP address

Destination NAT address

Souce port

Destination ports

Action : Allow or deny

Bytes sending and receiving ..

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.