Question on best practice for NAT/PAT and client access to firewall IP

Imagine that I have this scenario:
Client(IP=192.168.1.1/24)--[CiscoL2 switch]--Router--CiscoL2Switch----F5 Firewall IP=10.10.10.1/24 (only one NIC, there is not outbound and inbound NIC configuration on this F5 firewall)
One of my users is complaining about the following:
When clients receive traffic from the F5 firewall (apparently the firewall is doing PAT not NAT, the client see IP address 10.10.10.1.
Do you see this is a problem? Should I make another IP address range available and do NAT properly so that clients will not see the firewall IP address? I don't see this situation is a problem but please let me know if I am wrong.

Hi,
Static PAT is the same as static NAT, except it lets you specify the protocol (TCP or UDP) and port for the local and global addresses.
This feature lets you identify the same global address across many different static statements, so long as the port is different for each statement (you CANNOT use the same global address for multiple static NAT statements).
For example, if you want to provide a single address for global users to access FTP, HTTP, and SMTP, but these are all actually different servers on the local network, you can specify static PAT statements for each server that uses the same global IP address, but different ports
And for PAT you cannot use the same pair of local and global address in multiple static statements between the same two interfaces.
Regards
Bjornarsb

Similar Messages

Best practices for NAT/PAT?

Greetings:
My setup is
Cisco 1811 serving as a router/firewall to several windows 2003 servers at an ISP. Ive configured NAT on the router to expose http, https, and smtp ports on each of the servers to a unique public ip address within my x.x.x.230/29 address space.
The WAN port on the 1811 is configured with x.x.x.230/29. On the ServerA I NAT ports 25, 80, and 443 on that same x.x.x.230 address, while managing the 1811 itself using SSH on that same address as well.
On server B (local ip 192.168.0.3), I NAT the x.x.x.231 for ports 25. 80, and 443. On server C (local ip 192.168.0.4), I NAT the x.x.x.232 address for the same ports.
Can anyone offer a critique of this configuration and offer some ideas of the best practices topology-wise for providing routing, vpn and firewall functionality for these servers?
My question arises because now I have a site to site VPN with Server B at the local end and I am unable to connect to the server B smtp port due to the following nat statements. I can confirm that this is the case since by removing the statement I am able to connect.
Here is the NAT section of the show run:
ip nat inside source static tcp 192.168.0.2 443 interface FastEthernet0 443
ip nat inside source static tcp 192.168.0.2 80 interface FastEthernet0 80
ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0 overload
ip nat inside source static tcp 192.168.0.3 25 x.x.x.231 25 extendable
ip nat inside source static tcp 192.168.0.3 80 x.x.x.231 80 extendable
ip nat inside source static tcp 192.168.0.3 443 x.x.x.231 443 extendable
ip nat inside source static tcp 192.168.0.4 25 x.x.x.232 25 extendable
ip nat inside source static tcp 192.168.0.4 80 x.x.x.232 80 extendable
ip nat inside source static tcp 192.168.0.4 443 x.x.x.232 443 extendable
Would appreciate any and all comments on the way it is currently configured ass well as:
-How I might be able to change the config to follow a best-practice arrangement for the router/firewall and these servers.
TIA

Hi,
Static PAT is the same as static NAT, except it lets you specify the protocol (TCP or UDP) and port for the local and global addresses.
This feature lets you identify the same global address across many different static statements, so long as the port is different for each statement (you CANNOT use the same global address for multiple static NAT statements).
For example, if you want to provide a single address for global users to access FTP, HTTP, and SMTP, but these are all actually different servers on the local network, you can specify static PAT statements for each server that uses the same global IP address, but different ports
And for PAT you cannot use the same pair of local and global address in multiple static statements between the same two interfaces.
Regards
Bjornarsb

Best practice for OSB, OER and OSR

Hi,
I would like to know what are the best practices for using OSB, OER and OSR together in a run-time environment for a simple WSDL service.
From how I see it:
1) Create service-definition in OER
2) Create proxy and business service in OSB
3) Use harvester to harvest the proxy and business services in OER
4) Use Exchange Utility to publish the proxy service to OSR
Then the client and discover the proxy service and use OSB for invoking the operations from service.
Kindly correct me where I am wrong.
Some questions:
1) Do we ever publish business service to OSR? Or is it only meant for proxy services?
2) Is synching of OSB and OSR only meant when we are not using OER?
Looking forward...

Hi Anuj,
Thanks for the links, they have been helpful.
I understand now that OSR is only meant to contain only Proxy services. The synch facility is between OSR and OSB so that in case when you are not using OER, you can publish Proxy services to OSR from OSB. What I didn't understand was why there was a option to publish a Proxy service back to OSB and why it ended up as a Business service. From the link you provided, it mentioned that this case is for multi-domain OSBs, where one OSB wants to use the other OSB's service. It is clear now.
Some more questions:
1) In the design-time, in OER no Endpoints are generated for Proxy services. Then how do we publish our design-time services to OSR for testing purposes? What is the correct way of doing this?
Thanks,
Umar

Best Practice for E&C and Professional Services

Hello Experts,
Where do I find the Best Practice for implementing Oracle Projects, specific to Industries like E&C, Professional Services, Etc.
Thanks

Hi Anuj,
Thanks for the links, they have been helpful.
I understand now that OSR is only meant to contain only Proxy services. The synch facility is between OSR and OSB so that in case when you are not using OER, you can publish Proxy services to OSR from OSB. What I didn't understand was why there was a option to publish a Proxy service back to OSB and why it ended up as a Business service. From the link you provided, it mentioned that this case is for multi-domain OSBs, where one OSB wants to use the other OSB's service. It is clear now.
Some more questions:
1) In the design-time, in OER no Endpoints are generated for Proxy services. Then how do we publish our design-time services to OSR for testing purposes? What is the correct way of doing this?
Thanks,
Umar

Best Practice for Multiple iTunes and One Account?

My wife and I share our account for our iPhone Applications and Songs in iTunes.
Can someone point me to a topic that covers a best practice for multiple iTunes syncing?
I travel a lot and keep my iPhone synced to my Macbook Pro while she uses the workstation at home to sync to. We keep the addresses and contacts and calendars synced through MobileMe, however, I'm trying to find the best way of pushing applications and songs I've bought over to the other PC so they're still around while I'm traveling for her to sync with.
Thoughts?

Hi Steve,
Might be trying for solution for a long time, If i understood your question clear let me clarify you few points.
You are trying to access the bex query which is designed with the exit's in the background based on the logic and trying to call the entire dimensions and key-figures in a single connection. Then you are trying to map those data in the charts.
Steve, try to make more connections based upon the logic and split them. use the same query but split them by sales per customer group, sales per day, sales per week by making three different connections and try. You can merge the prompts from all connections.
Hope this Helps!!!
Sorry if i misunderstood your question.
--SumanT

Best practices for handling elements and symbols (including preloading)

I am trying to learn Edge Animate and I have not seen enough animations to know how this is typically handled and I searched the forum and have not found an answer either.
If you have many different elements and symbols for a project, what is the best practice for having them appear, disappear, etc. on the timeline? I ask this question not only from a performance based perspective, but also keeping in mind the idea of preloading. This is a 2 part question:
Part 1: Using elements and symbols later in the timeline:
Since artwork is always imported directly to the stage in an "always on" status, should we place a visibility OFF on every item until we need it?
or should they be opacity 0 until I need them?
or should they be set to visibility hidden until I need them?
Which of these is the best option if you don't want the element / symbol visible until later in the timeline? Does it matter?
Part 2: Impact on page loading
Does the above question have any impact upon page loading speed
or is this something handled in preloading?
or do you need to make a special preloader?
Thanks for the help.

Hi, escargo-
Good questions!
Part 1: Using elements and symbols later in the timeline:
Since artwork is always imported directly to the stage in an "always on" status, should we place a visibility OFF on every item until we need it?
or should they be opacity 0 until I need them?
or should they be set to visibility hidden until I need them?
Which of these is the best option if you don't want the element / symbol visible until later in the timeline? Does it matter?
I would recommend that you set your visibility to "off" instead of simply changing the opacity. The reason I suggest this is that when your visibility is set to off, your object's hit points also disappear. If you have any type of interactivity, having the object still visible but with 0 opacity will interfere with anything you have underneath it in the display order.
Part 2: Impact on page loading
Does the above question have any impact upon page loading speed
or is this something handled in preloading?
or do you need to make a special preloader?
Thanks for the help.
No, none of this has any impact on page load. As you already noticed, all of the assets of your project will load before it displays. If you want only part of your composition to load, you may want to do what we call a multi-composition project. There's a sample of that in the Edge Animate API in the Advanced section, and plenty of posts in the forums (and one in the team's blog) explaining how to do that.
http://www.adobe.com/devnet-docs/edgeanimate/api/current/index.html
https://blogs.adobe.com/edge/
Hope that helps!
-Elaine

Best Practices for BI, ADF and Oracle Forms installations on Weblogic

Hi, I'm researching options on upgrading to Oracle 11g Middleware. My company currently has Oracle Forms 10g running on Oracle Application Server.
We are interested in using Oracle Forms 11g, ADF and Jdeveloper, and Business Intelligence with Oracle's Weblogic 10.3.5.
Is there any whitepapers or documentation on best practices for installing alll of these components together?
For instance, can ADF ( with JSF 2.x ) be installed in the same domain as Oracle Forms 11g but use different managed servers?
Will Business Intelligence need to be in a seperate Oracle Home with it's own weblogic installation? I spend a lot of time trying to get the JSF upgraded to 2.x in the Business Intelligence installation and could not get it to work.
I know it's a pretty broad question but thank you for any direction on this.

Thanx for the reply! I read through the documents and they are very good at explaining how to install the different components individually. I still can't find much on installing them together. I hope it's not just going to be a trial and error thing.
So far I've installed done the following successfully:
Installed 10.3.5 weblogic
Forms and Reports 11g on top of 10.3.5
I've created an additional managed server for our ADF applications.
My next step is upgrading the JSF to 2.x. I would have to stage patches 12917525 and 12979653. I'm afraid it will break the forms and reports though. Any ideas?

Best Practices for Using Photoshop (and Computing in General)

I've been seeing some threads that lead me to realize that not everyone knows the best practices for doing Photoshop on a computer, and in doing conscientious computing in general. I thought it might be a good idea for those of us with some exprience to contribute and discuss best practices for making the Photoshop and computing experience more reliable and enjoyable.
It'd be great if everyone would contribute their ideas, and especially their personal experience.
Here are some of my thoughts on data integrity (this shouldn't be the only subject of this thread):
Consider paying more for good hardware. Computers have almost become commodities, and price shopping abounds, but there are some areas where spending a few dollars more can be beneficial. For example, the difference in price between a top-of-the-line high performance enterprise class hard drive and the cheapest model around with, say, a 1 TB capacity is less than a hundred bucks! Disk drives do fail! They're not all created equal. What would it cost you in aggravation and time to lose your data? Imagine it happening at the worst possible time, because that's exactly when failures occur.
Use an Uninterruptable Power Supply (UPS). Unexpected power outages are TERRIBLE for both computer software and hardware. Lost files and burned out hardware are a possibility. A UPS that will power the computer and monitor can be found at the local high tech store and doesn't cost much. The modern ones will even communicate with the computer via USB to perform an orderly shutdown if the power failure goes on too long for the batteries to keep going. Again, how much is it worth to you to have a computer outage and loss of data?
Work locally, copy files elsewhere. Photoshop likes to be run on files on the local hard drive(s). If you are working in an environment where you have networking, rather than opening a file right off the network, then saving it back there, consider copying the file to your local hard drive then working on it there. This way an unexpected network outage or error won't cause you to lose work.
Never save over your original files. You may have a library of original images you have captured with your camera or created. Sometimes these are in formats that can be re-saved. If you're going to work on one of those files (e.g., to prepare it for some use, such as printing), and it's a file type that can be overwritten (e.g., JPEG), as soon as you open the file save the document in another location, e.g., in Photoshop .psd format.
Save your master files in several places. While you are working in Photoshop, especially if you've done a lot of work on one document, remember to save your work regularly, and you may want to save it in several different places (or copy the file after you have saved it to a backup folder, or save it in a version management system). Things can go wrong and it's nice to be able to go back to a prior saved version without losing too much work.
Make Backups. Back up your computer files, including your Photoshop work, ideally to external media. Windows now ships with a quite good backup system, and external USB drives with surprisingly high capacity (e.g., Western Digital MyBook) are very inexpensive. The external drives aren't that fast, but a backup you've set up to run late at night can finish by morning, and if/when you have a failure or loss of data. And if you're really concerned with backup integrity, you can unplug an external drive and take it to another location.
This stuff is kind of "motherhood and apple pie" but it's worth getting the word out I think.
Your ideas?
-Noel

APC Back-UPS XS 1300. $169.99 at Best Buy.
Our power outages here are usually only a few seconds; this should give my server about 20 or 25 minutes run-time.
I'm setting up the PowerChute software now to shut down the computer when 5 minutes of power is left. The load with the monitor sleeping is 171 watts.
This has surge protection and other nice features as well.
-Noel

Best practice for Error logging and alert emails

I have SQL Server 2012 SSIS. I have Excel files that are imported with Exel Source and OLE DB Destination. Scheduled Jobs runs every night SSIS packages.
I'm looking for advice that what is best practice for production environment.Requirements are followings:
1) If error occurs with tasks, email is sent to admin
2) If error occurs with tasks, we have log in flat file or DB
Kenny_I

Are you asking about difference b/w using standard logging and event handlers? I prefer latter as using standard logging will not always data in the way in which we desire. So we've developed a framework to add necessary functionalities inside event handlers
and log required data in the required format to a set of tables that we maintain internally.
Please Mark This As Answer if it helps to solve the issue Visakh ---------------------------- http://visakhm.blogspot.com/ https://www.facebook.com/VmBlogs

Best Practice for Portal Patches and effort estimation

Hi ,
One of our client is applying the following patches
1. ECC 6.0 SP15(currently SP14)
2. ESS MSS SP15(currently SP14 with some level of functional customization )
3. EP 7 SP18(currently SP14)
We would like to kwow the best practice for applying portal patches and the effort estimation for redoing the portal devt on the new patch.
o   What is the overall level of effort with applying Portal patches?
o   How are all the changes to SAP objects handle? Do they have to be
     manually re-entered?
o What is the impact of having a single NWDI instance across the
    Portal Landscape during the Patch process?
Regards,
Revathi Raju.

Hi Revathi,
o What is the overall level of effort with applying Portal patches?
overall effort to apply the patch is apprx 1/2-1 days for NW7 system. This is exclude the patch files download because it's based on your download speed.
o How are all the changes to SAP objects handle? Do they have to be
manually re-entered?
Depending on your customization. Normally it wont effect if you created the customzation application apart from SAP standard application
o What is the impact of having a single NWDI instance across the
Portal Landscape during the Patch process?
Any change that related to NWDI, you might be need to re-deployed from NWDI itself.
Thanks
Regards,
AZLY

Best practices for graphic divs and classes

Nice day webmates, I am looking for good and simple tutorials
on creating divs with attractive looks, such as rounded corners,
own-customized (made in FW), displaying shadows... so I can type
content inside them... what are the best practices for this ?
thanks a lot in advance...

Bad example. When you increase text size that site becomes
unusable.
Best practice, don't use absolutely positioned divisions (aka
layers).
http://www.roundedcornr.com/
--Nancy O.
Alt-Web Design & Publishing
www.alt-web.com
"Sw Jiten" <[email protected]> wrote in message
news:g1f2i7$rve$[email protected]..
> here you can see an example: www.peru.com

What are the best practices for Database management and performance tuning?

Hello,
I want to ensure that I am using the best practices for managing and maintaining our Database.
Is there any documentation out there that outlines how to maintain and ensure top performance out of our database?
Thank you!
John Sefton

I appreciate the responses, however this is not the information I am looking for.
I am specificaly looking for best practices invloving the managment and performance tuning.
Example: are their tools that I can install that will monitor the size and response time of the database and alert me if there is degradation in performance?
Are there specific periodic activities I should be doing to garuntee that my database will continue to function that way it is supposed to?
Or is this a fire and forget solution that does not need this attention?

Best Practice for Image placement and Anchored Frames for use in Robohelp 9

Hi,
I'm looking for the best practices in how to layout my images in Framemaker 10 so that they translate correctly to Robohelp 9. I currently have images inside of Anchored frames that "Run into" the right side of my text. I've adjusted the size of the anchored frame so that my text flows correctly around the image. Everything looks good in Framemaker! Yeah! The problem is that when I link my Framemaker document to Robohelp, the text does not flow around my image in the same manner. On a couple of Robohelp screens the image is running into the footer. I'm wondering if I should be using tables in Framemaker in order to get the page layout that I'm looking for. Also, I went back and forth...is this a Framemaker question or is this a Robohelp question. Any assistance would be greatly appreciated.

I think Jeff is meaning this section of the RoboHelp forums:
http://forums.adobe.com/community/robohelp/robohelp_framemaker

Best practice for backing up and restoring forms

Greetings, I would like to pose a question to the forum and understand how many of you, if at all, "backup" your interactive forms so that in the event one or multple become corrupt, you have a method to recover the forms.
We recently experienced such a scenario in which the forms we developed in ABAP, and access through our portal, had become corrupt. What would happen to us when we attempted to access the form via the portal would be a SOAP error. SOAP errors, I understand, can happen for various reasons but prior to the incident, our forms were working just fine. We attempted to retrace our steps to identify the cause of the problem but found we could not replicate the issue. Through analysis of the forms, we identified the corruption in the master page and found that if we copied the sections of the form that were not corrupt to a new master page, the form would work properly again. Our thought is that this can not be the only method to recover from an incident like this and would like to know if others have experienced or have practices in place that would minimize the impact.
We asked SAP support whether or not there was a method to back up Interactive forms and the simple answer we received was to download the XML file from txn SFP. Can others relate to this strategy as a proper "backup" method or do other best practices exist that would be more ideal??
Thank you in advance!

I had many difficulties with this kind of errors like 2 years ago. Of course it was getting better with every patch level, and with LCD 8, LCD 8.1 etc.I don´t have any problems with the newest solution, but remember the feelings. I had to throw away a three days work once because of this "errors". But the solution is easy:
- use the versioning like you do in your ABAP development, that works ok
- if you would like to have an extra backup, copy the form into a backup, I mean with name like Z_YOURNAME_BCK_1
- if you still feel that is not enough, you can always set your forms to be dynamic, what makes the ADS webservice to change the way the forms are constructed (now it will have a internal structure, you can check this out, if you open a dynamic form in LCD outside SAP, it works like a charm, if you open just a printform, it asks for an import, which does not have anything in common with the template earlier). And you can backup every form you generate with these settings. If a problem appears, you can always open this outside SAP in LCD, copy the hierarchy and paste it into your SAP window with LCD development.
Hope that helps.
Regards Otto

Wireless Design - Best Practices for Data, Voice, and LBS

Hi,
I am currently in the process of designing a WLAN for a new hospital and I am getting some push back from my sales team. The requirements of the WLAN are data, voice, and location based services (RFID for medical equipment) ... needs to be 2.4 GHz for Guest and some apps/clients but primarily 5 GHz for most of the clients ... lastly needs to be N compatible for future use.
So, I did a predictive design with 1252's on the perimeter with 2.4 and 5 GHz patch antennas and 1142's in the middle to fill gaps ... I also scoped out 2 5508 for redundancy .... total design with -65 at my edges was 169. However, this is getting push back because of several cost issues ....
1. The bundle that Cisco offers for 5 100 AP license 5508 WLC is cheaper than buying 2 250 AP licenses WLC's ... which doesn't make any sense to me because I think 5 devices is over kill
2. The sales engineer is concerned about the power issues with the 1252's ... customer would rather not use power injectors ... and although they would have 6500's at there core ... they would only have basic switches in their IDF's so I wasn't sure which POE Switches would be able to handle 1252 but cost was an issue there as well
So, for my understanding when you are doing a WLAN design for LBS it's always best to have APs or antennas on the perimeter for better triangulation ... it makes more sense to me to do that with patch instead of Omni's ... however my sales engineer wants to use all 1142's ... so my question is what are the pro and cons behind using all Omni's or using Patch and Omni's?
Furthermore, if anyone has any documentation supporting why I would not use all Omni's that would be great because all the articles I have read on LBS just state that placement of APs is critical but doesn't give no specifics on whether it's a good practice to place them on the perimeter using a specific type of antenna or what.
Thanks in advance for you help and any ideas about this design!!!

1. The 5508 is expensive because it's alot faster than the 4400 plus there are some features exclusive to the 5508 such as OfficeExtend. As the old network design adage goes: Your design can be done correctly, cheap or fast. Choose two.
2. The 1250 requires 19.5w of power to enable FULL MCS rates to both radios. Only the 3560E, 3750E or the Sup720 is capable of supporting that. Upgrading the IOS of the 1250 to 12.4(10b)JDA3 will allow the AP to operate both radios at 15.4w BUT at a lower MCS rates. Correct placement of the AP and the correct use of the antennaes will also help in the signal distribution.
3. Patch antennaes are mostly directional. The 1140 is onmi-directional BUT the signal strength is not as powrful as the 1250 at full power. The AIR-ANT2451NV is an omni-directional patch designed for the 1250.
Cisco Aironet Antennas and Accessories Reference Guide
http://www.cisco.com/en/US/prod/collateral/wireless/ps7183/ps469/product_data_sheet09186a008008883b.html
Cisco Aironet 2.4 GHz and 5 GHz Antennas and Accessories
http://www.cisco.com/en/US/prod/collateral/wireless/ps7183/ps469/product_data_sheet09186a008022b11b.html
Some of the new patch antennaes for the 1250
Cisco Aironet Dual Band MIMO Low Profile Ceiling Mount Antenna (AIR-ANT2451NV-R)
http://www.cisco.com/en/US/prod/collateral/wireless/ps7183/ps469/data_sheet_ant2451nv.pdf
Cisco Aironet Very Short 5-GHz Omnidirectional Antenna (AIR-ANT5135SDW-R)
http://www.cisco.com/en/US/prod/collateral/wireless/ps7183/ps469/data_sheet_ant5135sdw.pdf
Cisco Aironet Very Short 2.4-GHz Omnidirectional Antenna (AIR-ANT2422SDW-R)
http://www.cisco.com/en/US/prod/collateral/wireless/ps7183/ps469/data_sheet_ant2422sdw.pdf
Cisco Aironet 5-dBi Diversity Omnidirectional Antenna (AIR-ANT2452V-R)
http://www.cisco.com/en/US/prod/collateral/wireless/ps7183/ps469/data_sheet_ant2452v.pdf
Cisco Aironet 5-GHz MIMO Wall-Mounted Omnidirectional Antenna (AIR-ANT5140NV-R)
http://www.cisco.com/en/US/prod/collateral/wireless/ps7183/ps469/data_sheet_ant5140nv.pdf
Cisco Aironet 5-GHz MIMO 6-dBi Patch Antenna (AIR-ANT5160NP-R)
http://www.cisco.com/en/US/prod/collateral/wireless/ps7183/ps469/data_sheet_ant5160np.pdf
Cisco Aironet 2.4-GHz MIMO Wall-Mounted Omnidirectional Antenna (AIR-ANT2450NV-R)
http://www.cisco.com/en/US/prod/collateral/wireless/ps7183/ps469/data_sheet_ant2450nv.pdf
Cisco Aironet 2.4-GHz MIMO 6-dBi Patch Antenna (AIR-ANT2460NP-R)
http://www.cisco.com/en/US/prod/collateral/wireless/ps7183/ps469/data_sheet_ant2460np.pdf

Question on best practice for NAT/PAT and client access to firewall IP

Similar Messages

Maybe you are looking for