How to Translate the Incoming Source IP address to an IP Address on the Trust Zone

Inbound DIP (Dynamic IP) Incoming source address NAT'd to a DIP Pool Screen OS 3.1.0

Route Mode

Using an inbound DIP pool feature, Any incoming source IP address can be translated to an IP address that resides on the Trusted Zone's Interface Broadcast Domain.

Example: Packet from DMZ host PC 192.168.1.10/24 (source IP) needs to come into the trust zone as IP address 10.100.2.50/24. To the trust zone host, 10.100.2.64, it should see a packet coming from 10.100.2.50, which is actually coming from the DMZ host.

Procedure:

1. Create a DIP pool on the Trusted interface
   

   set interface ethernet1/2 dip 4 10.100.2.50 10.100.2.50 [Enter]

2. Create a policy from DMZ zone to Trusted Zone with the defined DIP.
   

   set policy id 13 from DMZ to Trust "Any" "Any" "ANY" nat dip-id 4 Permit [Enter]

The following debug flow shows the packets during a successful 'ping" attempt:

--> Ping "request" DMZ zone host (192.168.1.10/24) To Trusted Zone host (10.100.2.64/24) using Inbound DIP on Trusted Zone. (10.100.2.50)

****** 06344.0: <DMZ/ethernet3/2> packet received [60]******
ethernet3/2:192.168.1.10/4608->10.100.2.64/512,1(8/0)
  route 10.100.2.64->0.0.0.0, to ethernet1/2
  routed 10.100.2.64 from ethernet3/2 to ethernet1/2
  vsys Root: ethernet3/2->ethernet1/2, zone 3->2(2), 192.168.1.10->10.100.2.64
  Permitted by Root policy!
  dip id = 4, 192.168.1.10/4608->10.100.2.50/1028
  policy id = 13(Permit), tunnel = 0
  Session created for first pack
  find matched sess
  core pak
  flow_ip_send: 10.100.2.50->10.100.2.64 => ethernet1/2
  no mac in session
  resolve 10.100.2.64 at ethernet1/2
  => 00065be40eb9
  arp entry found
  Send to ethernet1/2 (74)

-->Ping "reply" from Trusted Zone host (10.100.2.64/24) to DMZ zone host (192.168.1.10/24) using Inbound DIP on Trusted Zone. (10.100.2.50)

****** 06344.0: <Trust/ethernet1/2> packet received [60]******
ethernet1/2:10.100.2.64/512->10.100.2.50/1028,1(0/0)
  find matched sess
  core pak
  find next hop from vr=untrust-vr
  route 192.168.1.10->0.0.0.0, to ethernet3/2
  flow_ip_send: 10.100.2.64->192.168.1.10 => ethernet3/2
  mac 00104bf3d073 in session
  Send to ethernet3/2 (74)