Cisco | NAT from ServerFarm to Extranet

Kali ini kita membuat sebuah Lab yaitu mengenai NAT. yang akan kita simulasikan disini adalah yaitu Source-NAT dan Destination-NAT. Adapun NAT yg akan kita konfig disini diperangkat firewall forti.

Skenarario-1.
Lab ini dimana kita inign ketika host yg dari area serverfarm yaitu IP 10.87.30.10 mau akses ke area extranet (3party IP 172.16.20.10) maka IP 10.87.30.10 akan ditranstlae terlebih daulu ke 10.8.16.20 baru nyampe ke host IP 172.16.20.10. Arinya server/host yg diarea extranet tidak mengenal IP 10.87.30.10 tetapi yg dikenal adalah 10.8.16.20 tujuannya adalah demi keamanan sebuah server diarea trust. Kita tidak ingin real IP server kita diketahui oleh pihak luar.

Kita langsung konfiguasi semua router terlebih dahulu.
hostname SW-CORE-01
!
interface GigabitEthernet0/1
description LINK-to-EDGE-01
no switchport
ip address 13.13.13.2 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
negotiation auto
!
interface GigabitEthernet0/2
description LINK-to-R-WEB-SVR
no switchport
ip address 11.11.11.2 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
!
interface Vlan30
ip address 10.87.30.253 255.255.255.0
standby 1 ip 10.87.30.1
standby 1 priority 110
standby 1 preempt
ip ospf 1 area 0
!
router ospf 1
!
interface GigabitEthernet0/0
switchport access vlan 30
switchport mode access
negotiation auto
!
hostname SW-EDGE-01
!
interface Loopback1
ip address 192.168.255.254 255.255.255.255
ip ospf 1 area 0
!
interface GigabitEthernet0/0
description LINK-to-FW-EXTRANET-01
no switchport
ip address 14.14.14.1 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
speed 1000
duplex full
no negotiation auto
!
interface GigabitEthernet0/1
description LINK-to-CORE-01
no switchport
ip address 13.13.13.1 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
negotiation auto
!
router ospf 1
redistribute static subnets
!
ip forward-protocol nd
!
ip route 172.16.10.0 255.255.255.0 14.14.14.2
ip route 172.16.20.0 255.255.255.0 14.14.14.2
!

hostname R-EXTRANET
interface GigabitEthernet0/0
description LINK-to-SVR-TINY
ip address 15.15.15.1 255.255.255.252
no shut
exit
!
interface GigabitEthernet0/2
description LINK-TO-E-EXTRANET
ip address 16.16.16.1 255.255.255.248
no shut
exit
!
ip route 10.8.16.20 255.255.255.252 15.15.15.2 name Link_to_IP_SNAT
ip route 10.8.20.10 255.255.255.255 15.15.15.2 name Link_to_IP_DNAT
ip route 10.8.20.11 255.255.255.255 15.15.15.2 name Link_to_IP_DNAT
ip route 172.16.10.10 255.255.255.255 16.16.16.2 name Link_to_SVR_EXranet_1
ip route 172.16.20.10 255.255.255.255 16.16.16.2 name Link_to_SVR_EXranet_2

hostname R-BI
interface GigabitEthernet0/0
description LINK-TO-E-EXTRANET
ip address 16.16.16.2 255.255.255.248
no shut
exit
!
interface GigabitEthernet0/1
description LINK-to-SVR-TINY
ip address 172.16.10.1 255.255.255.0
no shut
exit
!
interface GigabitEthernet0/2
description LINK-to-SVR-UBUNTU
ip address 172.16.20.1 255.255.255.0
no shut
exit
!
ip route 10.8.16.0 255.255.255.0 16.16.16.1
ip route 10.8.20.0 255.255.255.0 16.16.16.1
!

Router Web_Server
conf t
hostname Web_Server
interface gi0/0
ip address 11.11.11.1 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface loopback 1
ip address 10.8.20.11 255.255.255.255
ip ospf network point-to-point
ip ospf 1 area 0
exit
!
router ospf 1
line vty 0 4
password 123
transport input all
exit
enable password 123

ip http server
ip http secure-server
username admin privilege 15 password 123
exit

Setting Firewall Forti

1. Interface IP

2. Statik Route

3. Firewall Security Policy

4. NAT (Source-NAT)

and..more detail setting...

VERIFIKASI:
1.Lakukan ping dari host 10.87.30.10 ke 172.16.20.10
2.Lakukan akses browser dari host 10.87.30.10 ke http://172.16.20.10:10000

Verfikasi di Firewall Forti
Log &Report --> Forward Traffic

Skenario-2
Di skenario yg kedua ini adalah DNAT. Kita inginkan adalah dari 172.16.10.10 akses 10.87.30.11, tetapi karna alasan keamana kita tidak ingin dari luar (3party) akses langsung ke ke 10.87.30.11, tetapi ditemabk ke virtual yaitu 10.8.20.11. Konfigurasi (settingan) ini dilakukan di firewall. Berikut capturenya.

Berikut Topologinya