topic Re: NAT Desination translate to network range in Firewall and Security Management

NAT Desination translate to network range

Ildar07 — Fri, 03 May 2024 11:30:46 GMT

Hello, everybody.

Is it possible to create NAT rule, which in destination will be a range of IP addresses?

Example: some_network -> some_external_IP translate to some_network -> Range_IP. I guess it is for some server balancing.

How it works on checkpoint - range or network objects in destination NAT? How checkpoint define which address will be used?

I need to know for Checkpoint R77.30 and last versions.

Re: NAT Desination translate to network range

PhoneBoy — Mon, 06 May 2024 14:54:12 GMT

Range objects can be used in the NAT rulebase, but primarily in the Source field.
You can use them in the destination field if the NAT is STATIC (not HIDE) and the range is the exactly the same size as the source.

I don't believe you can use the NAT rulebase for load balancing.
However, we have a specific object type for this purpose (Logical Server).
See: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SecurityManagement_AdminGuide/Topics-SECMG/Logical-Servers.htm
See also: https://support.checkpoint.com/results/sk/sk31162

Re: NAT Desination translate to network range

the_rock — Mon, 06 May 2024 15:57:08 GMT

Yes, it is possible, I did that before.

Andy