Destination NAT

Network Address Translation (NAT) is the process of mapping IP addresses belonging to one address space into another.

Destination NAT or popularly referred to as DNAT is a method of transparently changing the destination IP address of a packet and inturn performing inverse function for the replies.

DNAT is widely used when you want a service available on a Private DMZ network to be publically accessible – e.g: a WebServer

This article explains how to configure Destination NAT in Versa’s VOS.

High Level Topology

In this topology, we have an external user from the Internet trying to access a WebServer connected behind a Versa SD-WAN appliance. The user uses the external or the Public IP of the WebServer to access the resources.


A. Configure a Destination NAT rule on the appliance
B. Verify if an external user is able to access the WebServer using the Public IP

CGNAT related configuration is located under the Configuration > Services Tab.

Step 1: Configure a CGNAT Pool
Step 2: Map the IP of the host - ''in the CGNAT pool created above. 

In Destination NAT, the CGNAT pool refers to the untranslated IP address of the host / network. These are Private IP addresses given to the hosts / servers which reside inside the network DMZ and will be accessed publicly using a Public IP address.

Step 3: Under the 'Port' tab
- Check the 'Destination port'
- Give the 'Low' and High 'Port' as '80' as we are usign a WebServer in this use case. 
Step 4: Conifgure CGNAT Rule
Step 5: Configure Public IP of Server in 'Destination'. 

The Port Provided here can be different from that which the internal server is actually listening on. Enterprises can use this for additional security.

VOS automatically handles the Port Forwarding.

Step 6: Choose the NAT Mode as 'dnat-44' and map the destination pool created in Step 1 here. 
Logging can be enable to view the sessions in Analytics logs. 


When an external user tries to access the WebServer using the Public IP, the public IP gets translated to the Private (internal Server IP).

The CLI logs of the outbound session show the NAT where the Remote user with an host IP of is using and the Versa SD-WAN appliance translates this to

admin@Spoke1-edwardjones-cli> show orgs org edwardjones sessions nat brief
                                                                     NAT                     NAT           NAT
VSN  VSN   SESS                               DESTINATION      SOURCE    DESTINATION                                                                            NAT SOURCE     DESTINATION    SOURCE    DESTINATION
ID      VID    ID        SOURCE IP          IP                           PORT        PORT                PROTOCOL  NATTED  SDWAN  APPLICATION    IP                       IP                         PORT        PORT
0        2        6474        51767      8080                   6                  Yes           No        http                  51767       80
[ok][2019-07-05 12:34:30]


In this article we saw how to configure Destination NAT and verify the logs on CLI.