NAT logging

NAT is logged in rules where Log Generation | Per Connection are enabled. As per the recommendations made in Chapter 8, Introduction to Policies, Layers, and Rules, this should be the default setting for the firewall-only rules.

The NAT portion of the log card is really easy to understand, but I have seen repeated questions in forums regarding these two fields: NAT Rule Number and NAT Additional Rule Number.

To illustrate, let’s take a look at the following log card:

Figure 10.29 – The NAT Rule Number and NAT Additional Rule Number log fields

In the preceding screenshot, we can see the following:

• Traffic is accepted from host 10.10.10.21 [1] to host 200.100.0.5 [2].
• The translated source IP is 10.30.30.1 [3], which belongs to one of the virtual IPs of our cluster, and the translated destination is 10.30.30.5 [4].
• We can see that NAT Rule Number is 4 [5] and NAT Additional Rule Number is 9 [6].

This log...