All, To follow up on this, it's definitely a change in how the XG handles double NATed traffic. v18.5.4 works well with the shown rules and translates correctly. v19 seems to misunderstand double NATed traffic when it's forwarded from external to final internal addresses, and the NAT rule drops it with a local ACL violation. While double NATing (hopefully) doesn't show up much in corporate environments, it would be more common in a home environment. Solution here was to set my modem to bridge mode, thus removing one NAT layer. Some ISPs may not allow this, so it could be problematic for some.
↧