topic Re: Unstable traffic by NAT. in Firewall and Security Management

Unstable traffic by NAT.

Matlu — Mon, 10 Mar 2025 08:50:39 GMT

Hello,

I have a strange case.

I have an access rule, created to consume a domain.
The rule is working by FQDN (domain object).

The traffic is intermittent, for port 444 (Sometimes the rule works, and sometimes not).

When the rule does not work, it is because in the logs, you can see that the traffic at that time, does not NAT, and therefore can not reach the Internet.

The rule has that sense:

SRC: 192.168.70.0/0, 192.168.170.0/24, 192.168.130.0/24
DST: Domain Object -> ".sunat.gob.pe"
Services: 80, 8080, 444
Action: Accepted

The traffic for the other services like 80, and 8080, work fine, but the "instability" is when they want to consume that destination through port 444.

Sometimes it works, and sometimes it does not.

Any idea how to solve this intermittence?

I share 1 file, which contains the moment, when the rule works correctly, and the moment when the rule does not work.

Thanks for your comments.

Re: Unstable traffic by NAT.

the_rock — Thu, 21 Sep 2023 00:16:09 GMT

Make sure all options for NAT in global properties are checked.

Andy

Re: Unstable traffic by NAT.

Matlu — Thu, 21 Sep 2023 00:25:13 GMT

Hello,

Do you mean this option?

Cheers . 🙂

Re: Unstable traffic by NAT.

the_rock — Thu, 21 Sep 2023 00:26:42 GMT

si senor 🙂

Re: Unstable traffic by NAT.

Matlu — Thu, 21 Sep 2023 00:38:14 GMT

The "Global Properties" of the SmartConsole, is as the image you shared.

What makes me doubt is why the traffic at a certain moment stops doing NAT (this is why the traffic starts to match with the Cleanup Rule).

This happens at times.

It is very strange.

Re: Unstable traffic by NAT.

the_rock — Thu, 21 Sep 2023 00:42:53 GMT

Few times I helped people with this sort of issue, we solved it by clearing nat table. I know its intrusive and has to be done off hours, but seemed to do the trick

Andy

https://support.checkpoint.com/results/sk/sk32224

Re: Unstable traffic by NAT.

PhoneBoy — Thu, 21 Sep 2023 15:37:00 GMT

TAC is probably going to be necessary to get to the bottom of this.
Not sure why the port would matter here.