topic How to display nat translation in Checkpoint R80.30 in Firewall and Security Management

How to display nat translation in Checkpoint R80.30

minhhaivietnam — Mon, 19 Jun 2023 01:25:26 GMT

Dear experts and friends,

My firewall R80.30 is facing issue like this about NAT :

- I have product server , I nat static it to 172.16.100.100 , to communicate with product system of partner.

- But today, I move above IP nat to a Test-server . And I can telnet, ping from test-server to partner OK.

- Partner also ping my NAT ip ok.

But when partner starts pushing UDP traffic to my nat IP (172.16.100.100), I don't see any log on firewall , and my test-server does not receive anything,

I suspect that, NAT function on firewall is problem, maybe it still map NAT IP to product server, not test-server.

So my question is, how I display nat connection on firewall checkpoint, similar to show ip nat translation on router Cisco.

And how to clear a old NAT connection if it is still cached.

Thank you!!!

Re: How to display nat translation in Checkpoint R80.30

PhoneBoy — Mon, 19 Jun 2023 17:28:33 GMT

R80.30 is End of Support and you should upgrade to a supported release.
There isn't a command like that on Check Point, unfortunately.
The NAT configuration should be viewable in SmartConsole.

What precise steps did you take to change the NAT configuration?
Did you install the Access Policy after doing so?
Did you perform any tcpdumps or similar on the gateway to see if the traffic is even traversing the gateway?

Re: How to display nat translation in Checkpoint R80.30

minhhaivietnam — Tue, 20 Jun 2023 03:03:49 GMT

Thanks PhoneBoy,

Although I have not yet found root cause, it now does not happen error again after I move IP NAT back to product server. And I wait for the next test time to capture packet if problem happens again.

Re: How to display nat translation in Checkpoint R80.30

CheckPointerXL — Wed, 28 Jun 2023 14:52:41 GMT

maybe that command are good ? https://community.checkpoint.com/t5/Security-Gateways/Connection-Table/m-p/90348/highlight/true#M10930

anyway, like @PhoneBoy suggested, any NAT change to a "working" NAT rule will not take effect. You need to wait the end of the session or to destroy the connection from the table