Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Setting the IP Filter NAT port rewrite range
IP Filter rule basics
When a packet from a source reaches the Sidewinder G2 and matches
an IP Filter rule with NAT configured, the source port and source
address will be rewritten and the packet will then be forwarded to its
destination.
To facilitate this process, the IP Filter reserves a block of 200 ports for
its own use. The OS will never allow a process to bind to a port in
this range. Creating a TCP generic services proxy in this port range
will not work. The default range is set to 38000–38199.
If you need a port in IP Filter's reserved range (perhaps for a generic
proxy), the range can be moved by modifying the Start of Reserved
Ports field in the IP Filter Properties window. See “Viewing and
modifying general IP Filter properties” on page 7-25.
It is possible that an existing TCP proxy connection may be using a
port in the range you specify. In this case the ipfilter command
will fail. You should look at the current port usage by entering the
netstat -a command and adjust the IP Filter port range accordingly.
Specifying the source port in an IP Filter rule
The Sidewinder G2 enables you to specify the source port value to
use in an IP Filter connection. This capability is typically only used
when connecting to an application that requires the source port to be
a specific value. (In some cases the application will require the source
port to be the same value as the port on which the application is
listening.)
This capability is implemented by configuring NAT on the appropriate
IP Filter rule. This "source port" implementation of NAT, however, is
different from a normal implementation of NAT.
Normal—Each connection uses the same IP address but gets its
source port from a pool of ports. When using normal NAT rules,
the total number of connections is dependent on the number of
ports reserved for IP Filter in the IP Filter Properties window.
Understanding Policy Configuration 4-33