topic NAT not direcltly connected network in Firewall and Security Management

NAT not direcltly connected network

RHigui — Thu, 25 Mar 2021 14:54:40 GMT

Hi,

I have to give accès for an extenral partner to an internal server wich is in a network not direcktly connected to the Checkpoint R80.40 FW, below a basic schema that shows the network

Static routes are configured in both Firewall and the L3 router, I can ping the internal server from the FW but can't connect to it from external

This is my Nat rule,

I can see the packets arrived and accepted by firewall but no connection to that server,

Could you please see and help ?

thank you !

Re: NAT not direcltly connected network

Timothy_Hall — Fri, 26 Mar 2021 14:43:36 GMT

If the SAEIV_NAT_Address is "plucked" from the transit segment between the firewall and your Internet perimeter router, you will need to define a static proxy ARP for the SAEIV_NAT_Address because it is a manual NAT. See sk30197: Configuring Proxy ARP for Manual NAT

Re: NAT not direcltly connected network

RHigui — Fri, 26 Mar 2021 21:28:43 GMT

Thank you Tim,

I tried the proxy ARP and deosn't work, I tried to put the server on directly on the transit network (172.17.0.0) with an without proxy ARP and static NAT but not work.

Could you please give more info to fix this ?

Tnahks

Re: NAT not direcltly connected network

Timothy_Hall — Sun, 28 Mar 2021 12:25:28 GMT

You will need to do a tcpdump or cppcap on the firewall's internal interface to determine what is happening, my guess is the Nat_Node address does not have a proper proxy ARP and the inbound traffic is reaching the internal server but the reply is not coming back to the firewall.