How To Handle NAT Reflection on a Sonicwall for a Cisco Expressway One NIC Configuration

Holy hell folks. I ran into an issue over the last few weeks that seemed way harder than it should have been in my opinion. The problem I ran into was a mix of a difference in terminology between Cisco and Sonicwall, and how they handle traffic going from an internal LAN to a WAN IP. For instance, for this setup Cisco said that I needed a NAT reflection policy on my firewall. Well, Sonicwall doesn't know what a NAT reflection policy is, because they call it a loopback policy.

Another thing I ran into is how Sonicwall handles loopback, it's not how Cisco wants it done. For instance, when you want an internal LAN server to talk to another server on it's public IP address, Sonicwall NAT's the connection outbound in order to communicate to the public IP of the server you want to connect to,

Ok, that being said, here is a really basic diagram of my setup. The IP addresses have been changed to protect the innocent. In this example, 1.1.1.1 is the public IP of my Expressway-E device that is NAT'd to it's internal LAN IP of 192.168.1.3. The Expressway-E is setup with a single NIC, with static NAT enabled.

In this configuration, Expressway-C (192.168.1.2) sends traffic to the public NAT IP of Expressway-E (1.1.1.1) so Cisco says you need a NAT reflection policy on your firewall. In an ASA firewall, you would configure that as follows:

Simple enough right? Not on Sonicwall. What I found, as I mentioned before, is that with the loopback policy, which Sonicwall documentation, and support says needs to be configured from "All firewalled subnets" usually, causes the outbound traffic of Expressway-C to be NAT'd to a public IP address in order to send traffic to the public NAT'd IP address of Expressway-E. Because of that nonsense, in order for traffic to flow the way you need it to, you actually have to assign a public NAT address for Expressway-C as well, and configure it for NAT, then use the internal and external IP of Expressway-C in a specific loopback policy with Expressway-E... Confused yet?

Let me see if I can break this down...

On the Sonicwall, assign a public IP address for Expressway-C, let's use 1.1.1.2 in this example. You will need to create a NAT rule to to point 1.1.1.2 to 192.168.1.2. Make sure it's reflexive so that the outbound traffic of 192.168.1.2 goes out as 1.1.1.2 as well. Your network should now look like this:


Now you need to create your loopback policy (NAT reflection) as follows:

• Original Source: 192.168.1.2
• Translated Source: 1.1.1.2
• Original Destination: 1.1.1.1
• Translated Destination: 192.168.1.3
• Original Service: Any
• Translated Service: Original
• Inbound Interface: Any
• Outbound Interface: Any
• Comment: NAT reflection