Citrix SD-WAN

Firewall Traffic Redirection Support by Using Forcepoint in Citrix SD-WAN

August 24, 2022

Contributed by:

Forcepoint supports the following features, although SD-WAN supports only the firewall redirect feature:

IPSec with PKI
IPsec with PSK
Proxy chaining using PAC file configuration
Proxy chaining with standard headers
Proxy chaining with proprietary headers removing the need to configure the client¹s IP range - partnership/development
Firewall redirect (transparent proxy by Destination NAT)

The Destination NAT policy enables enterprises to route internet traffic through cloud-hosted security service using ForcePoint.

Review the following use case to understand how to configure Destination NAT in SD-WAN appliances and redirect internet traffic through a secure cloud-based firewall service.

Pre-requisites:

Log in to the Forcepoint portal site. Create a policy by providing the Enterprise Public IP address through which internet traffic needs to be redirected to Forcepoint. Obtain the Primary and Secondary IP addresses to which the internet traffic should be redirected.
In the SD-WAN GUI, on an SD-WAN appliance at the DC site, configure Internet service associated with WAN links.
Destination NAT is performed using Destination IP address of the internet traffic. This destination address is changed to the Forcepoint public IP address.
Configure Destination NAT policy by providing the source IP address and the primary IP address. The source IP is the internet IP address of the SD-WAN appliance inside ports 80 (http) and 443 (https) which is redirected/translated to the primary destination IP address of the cloud-based firewall gateway with outside ports 8081 (http) and 8443 (https) respectively.
After configuring DNAT policy, ensure that the Routes configured on the DC have the Internet service type selected for the SD-WAN network IP address.

You can configure NAT using Citrix SD-WAN Orchestrator service. For more information, see Network address translation.

localized image

Monitoring a Destination NAT Policy (Firewall)

You can also use the Citrix SD-WAN GUI to monitor the current DNAT policy configuration.

To monitor the current Destination NAT policy configuration:

In the Citrix SD-WAN GUI, navigate to Monitoring > Firewall > NAT Policies.
Select the tab that includes the statistics you want to monitor.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Firewall Traffic Redirection Support by Using Forcepoint in Citrix SD-WAN

August 24, 2022

Contributed by:

August 24, 2022

Contributed by:

Firewall Traffic Redirection Support by Using Forcepoint in Citrix SD-WAN

Monitoring a Destination NAT Policy (Firewall)

In this article