topic Is it able to set domain objects/groups as destination fro NAT rules ? in Firewall and Security Management

Is it able to set domain objects/groups as destination fro NAT rules ?

GeorgeF — Tue, 27 Feb 2024 23:46:09 GMT

Hi Experts,

We are using R81.20 take 26 as our firewall, and have some NAT rules. All the traffic is routed to Datacenter through a GRE tunnel.

But we still have some traffic needs to bypass the tunnel and NAT to internet directly. In the NAT rules, we use Host Group as destination and all hosts are IP address.

My question is, is it possible to put the Domain Groups ( Domain objects ) into the destination? including FQDN and non-FQDN. As the URL/domains are based on AWS CDN service and the IPs varies.

If it doesn't support, should I use DNS Checker to find out all the IP addresses' public resolution for the domains, and add all the IPs to the destination? That would be a manual work and needs to update frequently if the server's IP changed.

Thanks very much

Best regards

George

Re: Is it able to set domain objects/groups as destination fro NAT rules ?

Chris_Atkinson — Wed, 28 Feb 2024 01:06:26 GMT

I've not tested groups, however the following object types are supported in R81+

Source: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_RN/Topics-RN/Whats-New.htm?tocpath=What%27s%20New%7C_____1#Security_Gateway_and_Gaia

Re: Is it able to set domain objects/groups as destination fro NAT rules ?

the_rock — Wed, 28 Feb 2024 02:48:33 GMT

All of those work in R81.20, for sure, tested in the lab myself.

Best,

Andy