One of the more common issues you'll encounter is DNAT issues.
Without proper operations, websites and services will fail,
but it'll be up to you to troubleshoot and resolve these issues as they arrive.
Let's look into some of the more cantankerous issues that arise from DNAT.
DNAT is short for a destination NAT, which can also be called port forwarding.
The most common use of DNAT is to map private IPs to public IPs.
This, in turn,
would allow the internet to access the service that you're offering.
The most problematic issue with DNAT is incorrect.
port assignment.
More often than not, especially with the exhausted IPv4 public addressing scope,
it's not uncommon to have just one public IPv4 address for your organization.
Now let's say you had two websites offering two different web pages,
both over the HTTPS port of 443.
As it stands,
you could only place one of those web servers out to the internet
over 443 as they both have conflicting ports.
To resolve this, you'd have to map a new port translation to the second server.
And I know this does sound confusing,
so let's drop to a diagram to explain this further.
In this diagram, we have three IP addresses listed,
a public IP address with the IP of 130.211.198.130, a private IP
address with the IP of 192.168.1.1 attached to a web server, and
another private IP address with the IP of 192.168.1.2 Both web
servers offer a secure website over 443.
The issue arises when a user from the internet attempts to
access one of web servers as it has no way to determine
which server it can access.
To correct this issue,
one server will be assigned the DNAT port of 443, and the other
web server will be assigned the DNAT port of 8443. Now when the
web request comes into the firewall,
it'll have the ability to discern which web server wants to
access based on the destination port.
Let's drop to another quick video where we can actually
troubleshoot a DNAT issue. In this video, Jason,
the network administrator of Wired Brain Coffee,
is testing his DNAT configuration.
If everything works successfully,
he should land at the EdgeSwitch default landing page.
Let's see what happens.
Awesome.
It looks‑‑‑ Wait, no. This is the default landing page for EdgeSwitch 5XP.
It looks like Jason has configured two ports for the same DNAT IP.
Let's look at the configuration to see if we can correct this issue.
Ah, there it is.
Rule 1 has the destination overlapping port configured for 443.
This is directly conflicting with rule 2.
Let's move the EdgeSwitch 5XP to the port of 8443 instead
of 443. With our ports now successfully changed, let's see
if DNAT is working as planned.
Great.
We've successfully landed on the EdgeSwitch default landing page.
Now let's make sure our EdgeSwitch 5XP is still working over port 8443. Awesome.
Another win for us. Our DNET is now working as planned.