topic Re: NAT64 with R80.40 in Cloud Firewall

NAT64 with R80.40

pal — Sat, 13 Jun 2020 22:14:09 GMT

This is my first IPv6 implementation on Azure

Lab setup is

Ext win10: fd5d:7ce8:b6d5:1::4 (10.20.1.6)

fw Ext (eth0): fd5d:7ce8:b6d5:1::a14:205 (10.20.1.4)
fw Int (eth1): fd5d:7ce8:b6d5:2::4 (10.20.2.4)

webs1: 10.20.2.5

My NAT64 rule is

Log shows xlate dst as expected but xlate_src is empty

fw6 monitor and tcpdump on eth0 shows fw is sending reset

Any help is appreciated!

Re: NAT64 with R80.40

PhoneBoy — Mon, 15 Jun 2020 03:25:17 GMT

My understanding is that IPv6 is not supported in CloudGuard Gateways in Public Cloud, currently.
You can see it listed as a known limitation here:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk160753

Re: NAT64 with R80.40

pal — Mon, 15 Jun 2020 05:58:07 GMT

Appreciate your response. I read MDM, MUH v2 and IPv6 for Management interface are not supported. Security Gateway limitations mention about default kernel value and some commands. Please correct me if I missed the feature ID you are referring to.

Setup of (IPv6 LAN - Firewall - IPv6 LAN) end to end communication is working fine on Azure.

I redeployed everything locally with a 4600 appliance and seeing same behavior

I am wondering if any additional configuration is required for source NAT range to take effect.

Re: NAT64 with R80.40

PhoneBoy — Mon, 15 Jun 2020 06:05:07 GMT

This is stated in: VSECC-1097
But if you can see it in a physical appliance, I recommend a TAC case.

Re: NAT64 with R80.40

pal — Mon, 15 Jun 2020 06:12:40 GMT

VSECC-1097 applies to R80.20 and below correct?

I have a TAC case open and waiting to be assigned, thanks again.

Re: NAT64 with R80.40

PhoneBoy — Mon, 15 Jun 2020 06:17:09 GMT

If it's in the "Known Limitations" SK for R80.40, it applies there as well.
R80.20 was the first version it was documented in (meaning this isn't a new limitation).