The diagram shows my current network configuration. (Where X is 10).
I have the firewall interface E1/2 at the left configured to 192.168.10.1/24. It is in a trusted security zone. A DHCP server is configured at the ethernet 1/2 interface. Its range is 192.168.10.70 to 192.168.10.80. The PC at the gets the first IP address from the DHCP server of 192.168.10.70
E1/1 has an IP address of 172.16.1.110/24. It is in the untrusted security zone.
I have a virtual router routing between E1/1 and E1/2 as they in different networks with different network ID. The virtual router has a static default route with destination 0.0.0.0/0 and next hop IP address of 172.16.1.1. This is needed for traffic going to the internet.
I have a security policy to allow traffic from the Trust-L3 security zone to reach Untrust-L3 security zone.
The router just before the internet has NAT configured to translate the private IP address 172.16.1.110/24 to a public IP address.
At this point, the PC at the left can ping 192.168.10.1 (E/2) and 172.16.1.110 (E1/1). However it cannot ping 172.16.1.1 (internal-facing port of the router). It also cannot access the internet.
My question at this point is why can't it access the internet if NAT is already done at the router?
I learnt that by configuring a source NAT policy at the firewall to translate all packets from the untrust zone to have a source IP address of 172.16.1.110/24, it can fix this.
This means that an NAT is done at the firewall to translate a private IP address to another private IP address followed by the router's NAT to translate 172.16.1.110 to a public IP address. Only then can the PC reach the internet.
However, I do not understand why there must be a double NAT done as I always thought that NAT is only needed for a private IP address to a public IP address. Why is it that traffic exiting E1/1 cannot reach 172.16.1.1 without a source NAT?
Another related issue I have is that once configuring the source NAT, I can ping 172.16.1.1 and access the internet from the PC but can no longer ping 172.16.1.110.