topic Re: Disable NAT-T in Checkpoint GW. in Firewall and Security Management

Disable NAT-T in Checkpoint GW.

Matlu — Fri, 08 Sep 2023 23:38:39 GMT

Hello,

Is NAT-T enabled by default on Checkpoint equipment?

We have a GW, where we have created multiple VPNs with other clients, but specifically, with 1 client (Cisco ASA), we are having communication problems and according to the tests that the endpoint performs, suggests us to "disable" the NAT-T, but this option of disabling the NAT-T in the GW, affects in general to all the VPNs that you have created, right?

Could someone please confirm this for me.

Greetings.

Re: Disable NAT-T in Checkpoint GW.

PhoneBoy — Sat, 09 Sep 2023 01:35:02 GMT

Yes, it affects all VPNs that terminate on that gateway.

Re: Disable NAT-T in Checkpoint GW.

Matlu — Sun, 10 Sep 2023 19:19:27 GMT

Hello.

Is it advisable to disable NAT-T on a Checkpoint GW?

We have a S2S VPN against a Cisco ASA, but when we work the VPN using a NAT from our side, the other side, fails to see traffic on their equipment.

Example:

Our Real segment: 10.10.100.0/24
Remote segment: 10.11.1.50/32
NAT IP from our side: 172.10.15.100/32

When we use this flow, the remote peer does not see any traffic coming to its side (the tunnel on F1 and F2 are above).

Cisco ASA, indicates that they have bad experiences with Checkpoint when NAT is used to "hide" the real IPs/Segments, and they relate it to the use of NAT-T that is enabled by default in Checkpoint.

Greetings.

Re: Disable NAT-T in Checkpoint GW.

the_rock — Sun, 10 Sep 2023 22:08:20 GMT

What option are you referring to bro? You can disable/enable nat per vpn community, its in advanced tab under specific vpn community object.

Andy

Re: Disable NAT-T in Checkpoint GW.

Matlu — Sun, 10 Sep 2023 22:15:40 GMT

I mean disabling NAT-T for a VPN.

Since the remote peer assumes that it is the Checkpoint's NAT-T, which is generating communication problems in phase 2 of the VPN.

According to the documentation and PhoneBoy's comment, disabling NAT-T is a global setting that "affects" the entire GW.

But is it advisable to disable this global setting for the GW?

Re: Disable NAT-T in Checkpoint GW.

the_rock — Sun, 10 Sep 2023 22:18:18 GMT

I never seen any global settings for nat-t myself. Only one I know for vpn is one I mentioned.

Andy

Re: Disable NAT-T in Checkpoint GW.

PhoneBoy — Mon, 11 Sep 2023 17:02:30 GMT

There is a gateway-specific setting for NAT-T here:

However, it applies to all VPNs.
I've never heard of NAT-T itself causing issues with Cisco (though the differences in subnetting can cause issues).

Re: Disable NAT-T in Checkpoint GW.

Zolocofxp — Mon, 11 Sep 2023 17:37:41 GMT

You can disable NAT-T for that specific peer using Check Point Database Tool. Especifically, you need to disable it when initiating traffic.

I suggest you run a VPN Debug, I believe you are having a P2 negotiating issue that could be easily solved.

Re: Disable NAT-T in Checkpoint GW.

the_rock — Mon, 11 Sep 2023 17:43:41 GMT

Thanks for that, totally forgot about that setting 🙂

Re: Disable NAT-T in Checkpoint GW.

Matlu — Mon, 11 Sep 2023 17:57:33 GMT

The VPN is up and running on both phases, but they do not see the traffic coming to theWe see traffic coming out of the Firewall, and encrypted.

We have used TCPDUMP, FW MONITOR, and checked the logs, over and over again, the traffic is confirmed to be encrypted coming out of our Checkpoint, but they don't see it "coming in".

If we work with the real Local IPs, on both sides, they do see the traffic coming in.

They blame it on the NAT-T of Checkpoint.

According to the theory, Checkpoint is not the initiator in the NAT-T negotiation, as far as I remember, Checkpoint is normally in "listening" mode for this type of service

Re: Disable NAT-T in Checkpoint GW.

Zolocofxp — Mon, 11 Sep 2023 18:23:28 GMT

Have both ends send traffic to bring up both phases. In CLI, expert mode, have a look at established tunnel(s) for that peer. There should be only 1 s2s tunnel active with an Out SPI created, Traffic Selector should be /32 for you and your peer. If you see different results, share your findings. We might be able to help.

Re: Disable NAT-T in Checkpoint GW.

PhoneBoy — Mon, 11 Sep 2023 18:26:36 GMT

You are correct that, in releases prior to R80.10, that Check Point gateways will never initiate NAT-T (except SMB gateways that always have).

Re: Disable NAT-T in Checkpoint GW.

Matlu — Mon, 11 Sep 2023 18:51:28 GMT

So, nowadays, in version from R80.20 onwards, the GW Checkpoint, have the ability to "INITIATE" the communication on the NAT-T?

What is the default behavior of a GW with NAT-T enabled?
Is it in listening mode, or can it be the one that initiates this traffic?

Re: Disable NAT-T in Checkpoint GW.

the_rock — Mon, 11 Sep 2023 18:52:28 GMT

Did you confirm nat option inside vpn community?

Andy

Re: Disable NAT-T in Checkpoint GW.

Matlu — Mon, 11 Sep 2023 19:06:31 GMT

On our side, we have 3 segments:

10.10.120.0/24
10.10.122.0/24
10.10.249.0/24

We use a NAT for these 3 segments:

IP NAT: 10.11.83.145

The IPs on the CISCO ASA side are:

10.11.6.190
10.11.6.191
10.11.1.192

We are doing a Hide NAT.

We have configured the tunnel characteristics in this way.

Right now, the VPN is "down", since we are not testing right now (I understand that it is down, since the message is NO OUTBOUND SA).

I share the result of a test we did, when the tunnel is up.
There you can see that the traffic is encrypted, but the other side can not see the traffic on your computer.

Re: Disable NAT-T in Checkpoint GW.

Zolocofxp — Mon, 11 Sep 2023 19:34:59 GMT

I'd still recommend running a Debug to check your proposals. There should be only one tunnel from your NAT IP 10.11.83.145/32 to each of peers subnet 10.11.6.x/x and 10.11.1.x/x

Sorry for my awful writing skills btw... I'm a spanish native speaker. 😁

Re: Disable NAT-T in Checkpoint GW.

the_rock — Mon, 11 Sep 2023 19:41:09 GMT

I agree with that approach 🙂

Andy

Re: Disable NAT-T in Checkpoint GW.

Matlu — Mon, 11 Sep 2023 20:34:06 GMT

Entonces, mucho mas sencillo, transmitir la idea de mi problema, amigo 🤣

Re: Disable NAT-T in Checkpoint GW.

the_rock — Mon, 11 Sep 2023 21:04:55 GMT

🤣🤣🤣🤣

Re: Disable NAT-T in Checkpoint GW.

Matlu — Mon, 11 Sep 2023 21:06:59 GMT

In my scenario, what is the appropriate option in the configuration of the

"VPN TUNNEL SHARING" CONFIGURATION?

Currently, based on my diagram, it is set to "One VPN tunnel per subnet pair".

This is based on the fact that on our side, we have 3 segments, and on the Cisco ASA side, we have 3 Hosts.

Is this option the most viable?