topic Re: Additional NAT rule 1 in Firewall and Security Management

Additional NAT rule 1

m_bilal — Thu, 10 Nov 2022 06:31:08 GMT

Please anyone can explain what is Additional NAT rule 1?

theoretically. I have enabled bi-directional NAT in Global Properties.

Thank you.

Re: Additional NAT rule 1

PhoneBoy — Thu, 10 Nov 2022 20:34:37 GMT

Where exactly are you seeing this?
Please provide a screenshot.

Re: Additional NAT rule 1

the_rock — Thu, 10 Nov 2022 21:57:14 GMT

The log should point to the "link" to click on for it. As phoneboy asked, if you could provide a screenshot, it would help us.

Andy

Re: Additional NAT rule 1

Timothy_Hall — Sat, 12 Nov 2022 19:09:26 GMT

"Additional NAT Rule" appearing in a log card indicates that a second NAT rule was matched for the same connection. This is only possible if "bi-directional NAT" is set in the NAT Global Properties (it is set by default), and one automatically-generated NAT rule matches the source IP address of the packet, and another automatically-generated NAT rule matches the destination IP address on the packet. In this case both source IP and destination IP for the connection are NATted simultaneously. Most common NAT operations only change either source or destination but not both; this condition is an exception to that and certainly possible.

Note that this can only happen for two automatically-generated rules; if a manual NAT rule is matched first, only that one NAT rule can be matched, and an additional NAT rule match is impossible. It is also not possible to have an automatically-generated rule match one element of the packet (say source IP address) and a manual rule then match a destination IP address. Only one manual NAT rule can be matched for a connection, period.

Re: Additional NAT rule 1

the_rock — Sat, 12 Nov 2022 20:10:40 GMT

To excellent explanation from @Timothy_Hall , below is also great reference for this.

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topics-SECMG/NAT-Rules.htm