cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Meraki MX84 - NAT Internal IP to another Internal IP

Comes here often

Meraki MX84 - NAT Internal IP to another Internal IP

Hi

 

Is it possible to NAT an internal IP to access another internal IP?

I would like 192.168.1.45 to appear as 192.168.45.45 when connecting to 192.168.45.254.

 

Seen on some firewalls that you can create a policy that will masqurade the IP that is specified in the policy.

 

Thanks

 

5 REPLIES 5
Getting noticed

Re: Meraki MX84 - NAT Internal IP to another Internal IP

I think that would require something like this:

 

Portforwarding/NAT on 192.168.45.254:xx --> Object(192.168.45.45 translated to 192.168.1.45):xx

Where xx is the portnumber.

 

I don't believe thats possible yet, you can only create objects with Name and FQDN/IP-address as I've seen so far and not any object-NAT.

 

/CK

Head in the Cloud

Re: Meraki MX84 - NAT Internal IP to another Internal IP

NAT is only done when the communication is done through the WAN-port. The MX does not have this flexibility as ist is available for example on the Cisco ASA/FTD.

Kind of a big deal

Re: Meraki MX84 - NAT Internal IP to another Internal IP

Head in the Cloud

Re: Meraki MX84 - NAT Internal IP to another Internal IP

Wow, from the documentation, I would not expect this to work ...

And one question here is, if this is a "planned" feature or if it just works by accident and the behavior could change in a new firmware release. Actually I would have some doubts if I want to implement something like that.

Kind of a big deal

Re: Meraki MX84 - NAT Internal IP to another Internal IP

@KarstenI Not planned per se I don't think, but more a side effect of the way NAT was implemented. @GiacomoS commented on this solution in this post:

 

https://community.meraki.com/t5/Security-SD-WAN/HairPin-Nat-Loop-back-NAT/m-p/24563/highlight/true#M...

Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.