topic Re: NAT auto rules in Firewall and Security Management

NAT auto rules

salonso — Tue, 11 Apr 2023 23:17:51 GMT

Hello colleagues, question, how can I configure an automatic NAT with destination to 2 IPs, the first active and the second IP stand-by in case of failure of the first IP go to the 2nd IP?

Thanks!

Re: NAT auto rules

the_rock — Tue, 11 Apr 2023 23:24:40 GMT

You could set that up, then disable rules generated for the 2nd IP. Not 100% certain it would let you install policy that way, but I can try it in the lab tomorrow and verify.

Andy

Re: NAT auto rules

Chris_Atkinson — Tue, 11 Apr 2023 23:44:24 GMT

Are you working with an ISP redundancy scenario or something else and why auto-NAT specifically?

One thing you could experiment with which may be relevant is the use of Zone objects in the NAT policy.

Re: NAT auto rules

PhoneBoy — Wed, 12 Apr 2023 16:58:51 GMT

You will need to use a Dynamic Object as a destination in your NAT rulebase.
You will also need to write a script that will monitor the relevant conditions and update the correct definition of said object on the relevant gateways.
For information on the dynamic_objects command (used to set the content of a dynamic object), see: https://support.checkpoint.com/results/sk/skI1915

Re: NAT auto rules

Zolocofxp — Thu, 13 Apr 2023 21:11:36 GMT

I would consider the balancer (logical server object) approach. You will have a virtual IP that balances traffic across any number of servers you define.

Re: NAT auto rules

PhoneBoy — Fri, 14 Apr 2023 00:10:44 GMT

Logical Server objects don't do any monitoring, so not sure this would work in this case.