Step 1

Choose Devices > Device Management, and click the Edit () for the device.

Step 2

Click Interfaces.

Step 3

Click the Edit () for the interface that you want to use for inside.

The General tab appears.

1. Enter a Name up to 48 characters in length.

   For example, name the interface inside.

2. Check the Enabled check box.

3. Leave the Mode set to None.

4. From the Security Zone drop-down list, choose an existing inside security zone or add a new one by clicking New.

   For example, add a zone called inside_zone. Each interface must be assigned to a security zone and/or interface group. An interface can belong to only one security zone, but can also belong to multiple interface groups. You apply your security policy based on zones or groups. For example, you can assign the inside interface to the inside zone; and the outside interface to the outside zone. Then you can configure your access control policy to enable traffic to go from inside to outside, but not from outside to inside. Most policies only support security zones; you can use zones or interface groups in NAT policies, prefilter policies, and QoS policies.

5. Click the IPv4 and/or IPv6 tab.

   • IPv4—Choose Use Static IP from the drop-down list, and enter an IP address and subnet mask in slash notation or DHCP option .

     For example, enter 192.168.1.1/24

     

   • IPv6—Check the Autoconfiguration check box for stateless auto configuration and also for IPv6 DHCP or static configuration to enable the interface.

6. Click OK.

Step 4

Click the Edit () for the interface that you want to use for outside.

The General tab appears.

1. Enter a Name up to 48 characters in length.

   For example, name the interface outside.

2. Check the Enabled check box.

3. Leave the Mode set to None.

4. From the Security Zone drop-down list, choose an existing outside security zone or add a new one by clicking New.

   For example, add a zone called outside_zone.

5. Click the IPv4 and/or IPv6 tab.

   • IPv4—Choose Use DHCP, and configure the following optional parameters:

     • Obtain default route using DHCP—Obtains the default route from the DHCP server.

     • DHCP route metric—Assigns an administrative distance to the learned route, between 1 and 255. The default administrative distance for the learned routes is 1.

     

   • IPv6—Check the Autoconfiguration check box for stateless auto configuration.

6. Click OK.

Step 5

Click Save.

Step 1

Choose Devices > Device Management, and click the Edit () for the device.

Step 2

Choose DHCP > DHCP Server.

Step 3

On the Server page, click Add, and configure the following options:

• Interface—Choose the interface from the drop-down list.

• Address Pool—Set the range of IP addresses from lowest to highest that are used by the DHCP server. The range of IP addresses must be on the same subnet as the selected interface and cannot include the IP address of the interface itself.

• Enable DHCP Server—Enable the DHCP server on the selected interface.

Step 4

Click OK.

Step 5

Click Save.

Step 1

Choose Devices > Device Management, and click the Edit () for the device.

Step 2

Choose Routing > Static Route, click Add Route, and set the following:

• Type—Click the IPv4 or IPv6 radio button depending on the type of static route that you are adding.

• Interface—Choose the egress interface; typically the outside interface.

• Available Network—Choose any-ipv4 for an IPv4 default route, or any-ipv6 for an IPv6 default route.

• Gateway or IPv6 Gateway—Enter or choose the gateway router that is the next hop for this route. You can provide an IP address or a Networks/Hosts object.

• Metric—Enter the number of hops to the destination network. Valid values range from 1 to 255; the default value is 1.

Step 3

Click OK.

The route is added to the static route table.

Step 4

Click Save.

Step 1

Choose Devices > NAT, and click New Policy > Threat Defense NAT.

Step 2

Name the policy, select the device(s) that you want to use the policy, and click Save.

The policy is added the Firewall Management Center. You still have to add rules to the policy.

Step 3

Click Add Rule.

Step 4

Configure the basic rule options:

• NAT Rule—Choose Auto NAT Rule.

• Type—Choose Dynamic.

Step 5

On the Interface Objects page, add the outside zone from the Available Interface Objects area to the Destination Interface Objects area.

Step 6

On the Translation page, configure the following options:

• Original Source—Click the Add () to add a network object for all IPv4 traffic (0.0.0.0/0).

  

  Note	You cannot use the system-defined any-ipv4 object, because Auto NAT rules add NAT as part of the object definition, and you cannot edit system-defined objects. Similarly, you can create the NAT policy with a default host network [::/0] for all IPv6 traffic.

• Translated Source—Choose Destination Interface IP.

Step 7

Click Save to add the rule.

The rule is saved to the Rules table.

Step 8

Click Save on the NAT page to save your changes.

Step 1

Choose Policy > Access Policy > Access Policy, and click the Edit () for the access control policy assigned to the Firewall Threat Defense.

Step 2

Click Add Rule, and set the following parameters:

• Name—Name this rule, for example, inside_to_outside.

• Source Zones—Select the inside zone from Available Zones, and click Add to Source.

• Destination Zones—Select the outside zone from Available Zones, and click Add to Destination.

Leave the other settings as is.

Step 3

Click Add.

The rule is added to the Rules table.

Step 4

Click Save.

Step 1

Click Deploy in the upper right.

Step 2

Select the device in the Deploy Policies dialog box, then click Deploy.

Step 3

Ensure that the deployment succeeds. Click the icon to the right of the Deploy button in the menu bar to see status for deployments.