Using a specific IP address for internal to external traffic

[CedricMX]

Hello Team,

I am using a Mx 75 firewall on a location.

The ISP provide to us a /29 subnet so i can use 4 different public IP address.

I would like to know if it possible with Meraki to do this configuration : 

- For any port From a local device 1 to internet use the public IP number 1

- For any port From a local device 2 to internet use the public IP number 2

I know it was possible with other firewall solution.

Thanks for your help.

[alemabrahao]

Meraki MX does not support policy-based outbound NAT. So it is not possible.

[CedricMX]

From what i understand Meraki support inbound NAT only (from external to internal) ?

Is that correct ?

Thanks

[alemabrahao]

Yes, this is correct.

[PhilipDAth]

A 1:1 static NAT mapping will achieve this.

https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/NAT_an...

[CedricMX · Accepted solution]

PhilipDAth

 Thanks very much it is working.

[alemabrahao]

I was confused because the question was about inside-out NAT and outside-in 1:1 NAT.

They are not the same thing.

[PhilipDAth]

If you define a 1:1 NAT for inbound access - the MX also uses that same 1:1 NAT for all outbound access as well.

It is a "special exception".  I'm not sure it is even documented.

[alemabrahao]

That's called a makeshift solution. 🤣

[alemabrahao]

@PhilipDAth , I was thinking, it's fine to work that way, but in this case, he's opening a security vulnerability.

Exposing your host to the internet these days opens a very large vulnerability for a potential attacker.

He's taking the risk, but I personally have to disagree with that approach.

This business of working at any cost isn't my style; I prefer to assess the viability first and look at other options that offer less security risk.

This kind of thing bothers me a bit in the community—giving a solution, but it's not always the best or safest one.

I also make mistakes, but security is not something to be ignored.

[PhilipDAth]

When you create a 1:1 NAT it defaults to blocking all inbound access - it effectively acts solely as an outbound NAT.