3 ms·
None of which get through a firewall with a `deny` rule.
by deadbunny 3y ago
None of which get through a firewall with a `deny` rule.
- DarkmSparks 3y agoand how do you enforce using that firewall rule on tens of thousands of devices, each now with several public and private ips and several thousand routes in and out of the network?
- devman0 3y agoA stateful firewall is prerequisite for NAT implementations commonly deployed in most office and consumer settings due to the session tracking requirement. So you just stop doing the NAT part and the firewall continues to deny untracked ingress connections just like it did when NAT was running.
- DarkmSparks 3y agoNAT is only needed if you want to transition from a private network to a public one. ipv6 still needs nat configuring. nothing changes there. The only thing that changes from a network administrator perspective is it becomes much harder to ensure devices that should only have a private ip address do not have a public one. https://www.juniper.net/documentation/us/en/software/junos/nat/topics/topic-map/security-ipv6-nat.html https://www.juniper.net/documentation/us/en/software/junos/n...