topic Re: NAT in Firewall and Security Management

NAT

handiansudianto — Sat, 11 May 2024 14:18:32 GMT

Hello,

My 5800 checkpoint LAN IP is 10.103.253.10 and LAN subnet is 10.100.0.0/16, then i have 2 vpn site to site to azure and the tunnel already established.

Now i have requirement to change that the traffic from LAN subnet if want go to 1st VPN tunnel (Subnet 10.200.0.0/16) will go directly without any NAT.

Then i also need traffic from LAN subnet if want go to 2nd VPN Tunnel (Subnet 10.150.0.0/16) should be NATted using interface ip address (10.103.255.10).

Anyone here know how to make that NAT?

Re: NAT

the_rock — Sat, 11 May 2024 18:18:03 GMT

You can simply make manual nat rules in smart console based on those requirements.

Andy

Re: NAT

handiansudianto — Sun, 12 May 2024 03:54:46 GMT

Hello,

So my NAT setting is :

Original source : 10.100.0.0/16

Original destination : 10.150.0.0/16

And what should i choose on translate source so the traffic will be translated to my checkpoint interface?

Re: NAT

the_rock — Sun, 12 May 2024 12:18:42 GMT

Whatever the IP is that needs to be translated to.

Andy

Re: NAT

handiansudianto — Sun, 12 May 2024 13:33:16 GMT

Hi..

Already try with configuration below but have error

Original source : 10.100.0.0/16

Original destination : 10.150.0.0/16

Translated Source : 10.103.107.1

Re: NAT

the_rock — Sun, 12 May 2024 13:37:46 GMT

Let me test it in the lab and will let you know.

Andy

Re: NAT

the_rock — Sun, 12 May 2024 13:53:41 GMT

Works for me.

Andy

Re: NAT

Chris_Atkinson — Sun, 12 May 2024 15:23:06 GMT

Did you set it as hide or static?

Re: NAT

the_rock — Sun, 12 May 2024 15:24:27 GMT

Im fairly sure that can ONLY work with hide nat.

Re: NAT

Chris_Atkinson — Sun, 12 May 2024 15:28:18 GMT

Indeed I'm suggesting this is the likely cause for the error reported.

Re: NAT

the_rock — Sun, 12 May 2024 15:32:57 GMT

Yup, agree!

Re: NAT

handiansudianto — Mon, 13 May 2024 01:16:32 GMT

Hello,

I change the static nat to hide and the error was gone, but actually when i try RDP from 10.100.50.25 to Azure windows VM 10.50.10.10 then i check in the task manager, the source is still from host 10.100.50.25 and not from 10.103.107.1.

What i can see on the log there only decrypt message and in the message detail there are no NAT rule.

Re: NAT

the_rock — Mon, 13 May 2024 01:18:43 GMT

In such a case that you described, ONLY hide nat rule would work, as you cant do static nat from subnet to subnet translation, for the lack of the better term.

If IP is different, just change the natted IP in the translated packet, push policy and test.

Andy