topic Re: Performing SIC with Mgmt behind NAT in Firewall and Security Management

Performing SIC with Mgmt behind NAT

Antonio_M — Mon, 04 Feb 2019 21:54:19 GMT

Hello,

I'm unable to perform the initial SIC between a gateway and a management behind a NAT. I went through all the posts regarding this matter without success.

I've created a dummy object with the NATed IP and created the corresponding NAT rule between the private and NATed IP. The gateway performing the NAT is another Check Point device as well. I've tried with manual static NAT and using the "Add Automatic Address Translation rules" option under the management NAT section without success

The traffic is allowed in the gateway and I see the logs for the returning traffic as allowed and translated as well correctly, but running a tcpdump in the management the traffic does not reach the management, I only see SYN packets and retransmissions. For some reason the traffic is being consumed by the gateway?

Management runs R80.10 and gateway R77.30.

Any ideas?

Thanks in advance.

Re: Performing SIC with Mgmt behind NAT

HristoGrigorov — Tue, 05 Feb 2019 06:16:11 GMT

Do you have any other device in between NAT gateway and management server ?

Re: Performing SIC with Mgmt behind NAT

G_W_Albrecht — Tue, 05 Feb 2019 12:09:54 GMT

Did you use sk100583: Troubleshooting "SmartCenter behind NAT" issues ? Also, there is the more specialized sk66381: How to configure Management behind NAT in Security Gateway 80 / 1100 / 1400 Appliance setup.

Re: Performing SIC with Mgmt behind NAT

Antonio_M — Tue, 05 Feb 2019 20:10:12 GMT

No, just the Check Point cluster gateways.

Re: Performing SIC with Mgmt behind NAT

Antonio_M — Tue, 05 Feb 2019 20:14:32 GMT

Yes, I saw both. I tried creating a dummy host with the NAT IP and then creating a manual static NAT and also configuring the NAT properties on the real management object for the dynamic NAT.

What I don't understand is why in the auto-created NAT rule, the source and traslated IP address are the same, the internal IP. Shouldn't be the translated IP the specified in the "hide behind IP address"?

Any ideas?

Re: Performing SIC with Mgmt behind NAT

Maarten_Sjouw — Tue, 05 Feb 2019 21:41:07 GMT

What you see in the Automatic NAT rule is the Object of the NATted host, in both Original an Translated column that looks a bit confusing and is one of the reasons why we mostly add the NAT ip in the comment, so that when you hover over the object it will show you both IP's.

Re: Performing SIC with Mgmt behind NAT

Antonio_M — Wed, 06 Feb 2019 19:18:36 GMT

When I hover over I see the same IP which is the internal one, not the NATted.

Really frustating this, can't make it work.