Home > Security Appliances > NAT and Port Forwarding > 1:1 NAT Rules not working properly after installing MX

1:1 NAT Rules not working properly after installing MX

Table of contents
No headers

There are circumstances where 1:1 NAT rules won't work after installing an MX. This commonly occurs after replacing a firewall with an MX Security Appliance, because the upstream modem or router has not updated its ARP table and needs to be restarted or cleared. The upstream modem/router handles the packets that are being forwarded to the MX that are not addressed to the public address of the MX.

For more information on the ARP protocol refer to this article.

For more information on 1:1 NAT configuration on the MX security appliance refer to our product documentation.

 

In this example the MX will be replacing a third party firewall with current active 1:1 NAT rules using multiple public IP addresses. The MX is currently configured with the IP addresses of the previous firewall and 1:1 NAT rules as shown in the figure below: 

c9977b39-2abb-455b-acb2-6dd2d045d792

 

If the upstream router or modem does not have its ARP table cleared, it will attempt to send requests to the previous third party firewall MAC address. However, the MX will ignore this packet if the upstream modem or router is not restarted. This can be illustrated by the capture and diagram below:

bed48549-296a-43b6-8c64-1bd5ad533d5a

 

29d33941-5536-4ee2-a66e-cef3a691ccaa

 

Once the upstream device ARP tables are cleared, or it is restarted, the ARP will resolve correctly and the requests will now be forwarded with the correct MAC address, allowing the 1:1 NAT to function. This is shown in the following diagram and captures of both the Internet and LAN interfaces of the MX:

 

39c37288-99e8-4201-a4bb-d29fe2cdd1f1

 

f78b6d7e-4c9b-4988-91cb-9f4a54f03993

 

545cecd6-7349-4f90-b865-0f1ec9357b75

 

You must to post a comment.
Last modified
16:16, 18 Feb 2016

Tags

Classifications

This page has no classifications.

Explore Meraki

You can find out more about Cisco Meraki on our main site, including information on products, contacting sales and finding a vendor.

Explore Meraki

Contact Support

Most questions can be answered by reviewing our documentation, but if you need more help, Cisco Meraki Support is ready to work with you.

Open a Case

Ask the Community

In the Meraki Community, you can keep track of the latest announcements, find answers provided by fellow Meraki users and ask questions of your own.

Visit the Community