topic Re: NAT in S2S VPN deployment. in Firewall and Security Management

NAT in S2S VPN deployment.

Matlu — Wed, 28 Jun 2023 16:25:27 GMT

Hello,

A query, I have a S2S IPsec VPN against a third party, in which, on our side we have the need that "the remote peer" does not know us with the real IPs of our servers.

These are our Real IPs:
10.7.12.124
10.7.106.114
192.168.216.50

Destination IP of the remote peer:
69.20.50.41

These 3 IPs, must "present" themselves to the remote peer, with the NAT IP -> 172.26.15.254

Checkpoint requires that in this case, 3 Hide NAT type rules are created for each of the real IPs, right?

It is not possible to work it in only one NAT rule?

Cheers. 🙂

Re: NAT in S2S VPN deployment.

the_rock — Wed, 28 Jun 2023 16:39:14 GMT

Hey bro,

Make sure NAT is enabled inside vpn community and if its static nat rules, then they may need to be separate.

Andy

Re: NAT in S2S VPN deployment.

Matlu — Wed, 28 Jun 2023 16:49:23 GMT

Buddy

The TAC told me that in order for Checkpoint, to take my manual NAT rules into account, I have to disable the checkbox of the option that you see in the following image. 😄

For now, my manual NAT works fine, but it is configured as a 1 - 1 NAT.
And what I want is that on my side, there are 3 servers with different IPs, that can reach the other side of the VPN, with a single NAT IP.

Is it possible to make a Hide NAT, using as origin a "group object" and putting there, all the IPs that I want to leave my side ????

Greetings.

Re: NAT in S2S VPN deployment.

the_rock — Wed, 28 Jun 2023 16:59:39 GMT

Sorry, my bad, I believe TAC is correct. Also, as per below, makes sense

VPN Communities - Advanced (checkpoint.com)

Btw, if its hide NAT rule, then group should work.

Andy

Re: NAT in S2S VPN deployment.

CaseyB — Wed, 28 Jun 2023 19:35:47 GMT

Yes, it is possible to setup groups in the NAT rule base for your hide NAT. I use this feature quite often.

You can absolutely put those 3 servers into a group and specify hide behind 172.26.15.254 when talking to the other remote network.

Re: NAT in S2S VPN deployment.

the_rock — Wed, 28 Jun 2023 19:37:19 GMT

100% that works, agree.

Andy

Re: NAT in S2S VPN deployment.

Matlu — Wed, 28 Jun 2023 20:01:09 GMT

Thanks for the support, guys.

Cheers. 🙂

Re: NAT in S2S VPN deployment.

the_rock — Wed, 28 Jun 2023 20:09:39 GMT

FYBFOC = for you bro, free of charge 🙂