Citrix SD-WAN

Firewall Traffic Redirection Support by Using Forcepoint in Citrix SD-WAN

May 5, 2021

Contributed by:

S C

Forcepoint supports the following features, although SD-WAN supports only the firewall redirect feature:

IPSec with PKI
IPsec with PSK
Proxy chaining using PAC file configuration
Proxy chaining with standard headers
Proxy chaining with proprietary headers removing the need to configure the client¹s IP range - partnership/development
Firewall redirect (transparent proxy by Destination NAT)

The Destination NAT policy enables enterprises to route internet traffic through cloud-hosted security service using ForcePoint.

Review the following use case to understand how to configure Destination NAT in SD-WAN appliances and redirect internet traffic through a secure cloud-based firewall service.

Pre-requisites:

Log in to the Forcepoint portal site. Create a policy by providing the Enterprise Public IP address through which internet traffic needs to be redirected to Forcepoint. Obtain the Primary and Secondary IP addresses to which the internet traffic should be redirected.
In the SD-WAN GUI, on an SD-WAN appliance at the DC site, configure Internet service associated with WAN links.
Destination NAT is performed using Destination IP address of the internet traffic. This destination address is changed to the Forcepoint public IP address.
Configure Destination NAT policy by providing the source IP address and the primary IP address. The source IP is the internet IP address of the SD-WAN appliance inside ports 80 (http) and 443 (https) which is redirected/translated to the primary destination IP address of the cloud-based firewall gateway with outside ports 8081 (http) and 8443 (https) respectively.
After configuring DNAT policy, ensure that the Routes configured on the DC have the Internet service type selected for the SD-WAN network IP address.

For additional information about NAT support in Citrix SD-WAN, see the following topic, Configure NAT

localized image

Configuring Destination NAT (DNAT)

Use the Citrix SD-WAN GUI to configure Destination NAT (DNAT). In the configuration, add one or more DNAT policies that redirect traffic matching a specific destination IP address and port.

To configure Destination NAT:

In the SD-WAN SE/VPX GUI, go to Configuration -> Virtual WAN -> Configuration Editor. Click Open to open an existing package. Select a saved configuration package. You can also create DNAT rules while building the network configuration.

At the DC (MCN), configure Internet Service. Go to Connections -> Firewall.
Click + Add to add a DNAT policy.
In the Add Destination NAT Policy dialog box, provide the following information:
- Priority
- Direction
- Service Type
- Service Name
- Inside IP Address
- Inside Port
- Outside IP Address
- Outside Port
Provision Destination NAT rules for Firewall traffic redirect, similar to static NAT.
Enter the matching criteria and the Destination IP/port to be NATed.
Perform connection matching of the DNAT rule with statistics.
Remove or Update DNAT rules during configuration update.

Monitoring a Destination NAT Policy (Firewall)

You can also use the Citrix SD-WAN GUI to monitor the current DNAT policy configuration.

To monitor the current Destination NAT policy configuration:

In the Citrix SD-WAN GUI, navigate to Monitoring > Firewall > NAT Policies.
Select the tab that includes the statistics you want to monitor.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Firewall Traffic Redirection Support by Using Forcepoint in Citrix SD-WAN

May 5, 2021

Contributed by:

S C

May 5, 2021

Contributed by:

S C

Firewall Traffic Redirection Support by Using Forcepoint in Citrix SD-WAN

Configuring Destination NAT (DNAT)

Monitoring a Destination NAT Policy (Firewall)

In this article