Sophos XG: How to config Source NAT rule (may use IP static or dynamic)

This article demonstrates how to create a Source NAT firewall rule so that outbound traffic from the local will use a different static IP address or you can use MASQUERADE to configure SNAT with dynamic IP address. In order to be flexible, businesses don’t need to buy static IP

How to configure

• Login to Sophos XG Firewall by Admin account

• Create a LAN layer where you want NAT
• Network -> Interfaces -> Click Add Interface

• Choose Add Alias

• Fill in the information
• You can NAT 1-1 by select only one LAN IP address or multiple LAN IP addresses by selecting the network layer

-> Click Save

• Select Host and Services -> IP Host -> Click Add to create a WAN IP address that you want to user to put NAT in Firewall Rule -> Click Save

• Firewall -> Click Add Firewall Rule -> Select Business application rule

• Choose DNAT/Full NAT/Load Balancing in Application template

• In Source zones: Choose LAN
• In Allowed client networks: Choose Network or IP that you was created before
• In Destination host/network: Choose IP WAN that you was create before

-> Click Save to save configuration Source NAT

• If your IP WAN is not a static IP address, it is a dynamic IP address
• In Advanced -> Choose Rewrite source address (Masquerading)
• Choose device’s port WAN

-> Click Save

** If you have difficulty configure Sophos products in VietNam, please contact us:

Hotline: 02862711677

Email: info@thegioifirewall.com