• SonicOS 7.1 Rules and Policies
• Overview
  • About SonicOS
  • SonicOS Workflow
  • How to Use the SonicOS Administration Guides
  • Guide Conventions
• Access Rules
  • Setting Firewall Access Rules
    • About Connection Limiting
    • Using Bandwidth Management with Access Rules
      • Enabling Bandwidth Management on an Access Rule
    • Creating Access Rules
    • Configuring Access Rules for IPv6
      • About Stateful Packet Inspection Default Access Rules
    • Enabling and Disabling Access Rules
    • Editing Access Rules
    • Deleting Access Rules
    • Restoring Access Rules to Default Settings
    • Displaying Access Rules
      • By Zones
      • By Column
    • Displaying Access Rule Traffic Statistics
    • Configuring Access Rules for NAT64
    • Configuring Access Rules for a Zone
    • Access Rules for DNS Proxy
    • User Priority for Access Rules
  • Access Rule Configuration Examples
    • Enabling Ping
    • Blocking LAN Access for Specific Services
    • Allowing WAN Primary IP Access from the LAN Zone
• NAT Rules
  • About NAT in SonicOS
  • About NAT Load Balancing
    • Determining the NAT LB Method to Use
    • Caveats
    • How Load Balancing Algorithms are Applied
    • Sticky IP Algorithm Examples
      • Example One - Mapping to a Network
      • Example Two - Mapping to an IP Address Range
  • About NAT64
    • Use of Pref64::/n
  • About FQDN-based NAT
  • About Source MAC Address Override
  • Viewing NAT Policy Entries
    • Changing the Display
    • Filtering the Display
    • Displaying Information about Policies
  • Adding or Editing NAT or NAT64 Rule Policies
  • Deleting NAT Policies
  • Creating NAT Rule Policies: Examples
    • Creating a One-to-One NAT Policy for Inbound Traffic
    • Creating a One-to-One NAT Policy for Outbound Traffic
    • Inbound Port Address Translation via One-to-One NAT Policy
    • Inbound Port Address Translation via WAN IP Address
    • Creating a Many-to-One NAT Policy
    • Creating a Many-to-Many NAT Policy
    • Creating a One-to-Many NAT Load Balancing Policy
    • Creating a NAT Load Balancing Policy for Two Web Servers
    • Creating a WAN-to-WAN Access Rule for a NAT64 Policy
    • DNS Doctoring
• Routing
  • About Routing
    • About Metrics and Administrative Distance
      • About Metrics
      • About Administrative Distance
    • Route Advertisement
    • ECMP Routing
    • Policy-based Routing
    • Policy-based TOS Routing
    • PBR Metric-based Priority
    • Policy-based Routing and IPv6
    • OSPF and RIP Advanced Routing Services
      • About Routing Services
        • Protocol Type
        • Maximum Hops
        • Split-Horizon
        • Poison Reverse
        • Routing Table Updates
        • Subnet Sizes Supported
        • Autonomous System Topologies
      • OSPF Terms
    • Drop Tunnel Interface
    • App-based Routing
  • Rules and Policies >
    • Configuring
      • Adding Static Routes
      • Probe-Enabled Policy-based Routing Configuration
• DNS Rules
  • Creating DNS Filtering Profiles
  • Configuring DNS Filtering
    • Creating DNS Policy Rules
      • Editing DNS Policies
      • Deleting DNS Policies
    • Configuring Global DNS Filtering Settings
    • Configuring DNS Filtering Custom Domains
  • Viewing DNS Information
    • Viewing DNS Using the Dashboard
    • Viewing DNS Filtering Reports
• Content Filter Rules
  • About Content Filtering Rules (CFS)
    • About Content Filter Rules
    • About UUIDs for CFS Policies
    • About Content Filter Action Objects
    • How CFS Works
  • Configuring CFS Policies
    • About the Content Filter Rule Table
      • Searching the Content Filter Rule Table
    • Adding a Content Filter Rule
    • Editing a Content Filter Rule
    • Deleting Content Filter Rules
• App Rules
  • About App Rules
    • What are App Rules?
      • About App Rules Policies
      • About App Rules Capabilities
    • Benefits of App Rules
    • How Does Application Control Work?
    • About App Rules Policy Creation
    • Licensing App Rules and App Control
    • Terminology
  • Rules and Policies > App Rules
    • Configuring an App Rules Policy
  • Verifying App Rules Configuration
    • Useful Tools
      • Wireshark
      • Hex Editor
  • App Rules Use Cases
    • Creating a Regular Expression in a Match Object
    • Policy-based Application Rules
    • Logging Application Signature-based Policies
    • Compliance Enforcement
    • Server Protection
    • Hosted Email Environments
    • Email Control
    • Web Browser Control
    • HTTP Post Control
    • Forbidden File Type Control
    • ActiveX Control
    • FTP Control
      • Blocking Outbound Proprietary Files Over FTP
      • Blocking Outbound UTF-8 / UTF-16 Encoded Files
      • Blocking FTP Commands
    • Bandwidth Management
    • Bypass DPI
    • Custom Signature
    • Reverse Shell Exploit Prevention
      • Generating the Network Activity
      • Capturing and Exporting the Payload to a Text File Using Wireshark
      • Creating a Match Object
      • Defining the Policy
• Endpoint Rules
• SonicWall Support
  • About This Document

Creating a NAT Load Balancing Policy for Two Web Servers

This is a more specific example of a one-to-many NAT load balancing policy. To configure NAT load balancing in this example, complete the following tasks:

• Enabling Logging and Name Resolution for Logging
• Creating Address Objects and an Address Group
• Creating the Inbound NAT Load Balancing Policy
• Creating the Outbound NAT Policy
• Creating a NAT Load Balancing Policy for Two Web Servers
• Creating a NAT Load Balancing Policy for Two Web Servers

Enabling Logging and Name Resolution for Logging

It is strongly advised that you enable logging for all categories, and enable name resolution for logging.

To enable logging

1. Navigate to the DEVICE | Log > Settings.

   

2. Click the Edit icon at the top of the table.

   The Edit Attributes of All Categories dialog appears.

   

1. Choose debug from the Event Priority drop-down menu.

2. Select Enable for Display Events in Log Monitor and for any other desired settings.

   Debug logs should only be used for initial configuration and troubleshooting, and it is advised that once setup is complete, you reset the logging level back to a more appropriate level for your network environment.

3. Click Save.

4. Click Accept on the DEVICE | Log > Settings page to save and activate the changes.

To enable log name resolution

1. Navigate to the DEVICE | Log > Name Resolution page.

2. Choose DNS then NetBIOS from the Name Resolution Method drop-down menu. The DNS Settings section displays.

   

3. Select the Inherit DNS Settings Dynamically from WAN Zone option. The Log Resolution DNS Server fields are filled automatically and cannot be changed.

4. Click Accept to save and activate the changes.

Creating Address Objects and an Address Group

To create address objects and an address group

1. Navigate to the OBJECT | Match Objects > Addresses page.

2. Create address objects for both of the internal web servers as well as for the Virtual IP on which external users access the servers. For example:

   

   

   

3. Click over to the Address Groups tab. Click +Add.

4. Create an address group named www_group and add the two internal server address objects you just created. For example:

   

Creating the Inbound NAT Load Balancing Policy

To configure the inbound NAT load balancing policy

1. Navigate to the POLICY | Rules and Policies > NAT page.

2. Click +Add and create an Inbound NAT Rules policy for www_group to allow anyone attempting to access the Virtual IP to get translated to the address group you just created.

   Do not save the NAT rule just yet.

3. Click the Advanced/Actions view. Under NAT Method, select Sticky IP as the NAT Method.

4. Under High Availability, select Enable Probing.

5. For Probe type, select TCP from the drop-down menu, and type 80 into the Port field.

   This means that SonicOS checks to see if the server is up and responding by monitoring TCP port 80 (which is what people are trying to access).

6. Click Add to save and activate your changes.

   Before you go any further, check the logs and the status page to see if the resources have been detected and have been logged as online. Two alerts appear as Firewall Events with the message Network Monitor: Host 192.160.200.220 is online (with your IP addresses). If you do not see these two messages, check the previous steps.

7. Click Close.

Creating the Outbound NAT Policy

To configure the corresponding outbound NAT policy

1. Navigate to the POLICY | Rules and Policies > NAT page.

2. Click +Add and create an Outbound NAT policy for www_group to allow the internal servers to get translated to the Virtual IP when accessing resources out the WAN interface (by default, the X1 interface). The Original / Translated settings are shown here. Advanced / Actions settings are not necessary.