topic Re: Many to One NAT in Firewall and Security Management

Many to One NAT

Ihenock1011 — Thu, 19 Dec 2024 12:43:25 GMT

Hi All

Is that possible in checkpoint security gateway r81.10 to do the below many to one NAT IP ?

Src: 172.16.16.0/24

Dest: 192.168.25.1/32

Src NAT: 10.10.15.2

Dest NAT : Original

Thanks,

Re: Many to One NAT

AkosBakos — Thu, 19 Dec 2024 13:32:29 GMT

Hi @Ihenock1011

Maybe I misunderstood something but NAT is for this:

Akos

Re: Many to One NAT

CaseyB — Thu, 19 Dec 2024 13:45:21 GMT

Yes, just make sure it is a HIDE NAT.

Re: Many to One NAT

Ihenock1011 — Thu, 19 Dec 2024 13:55:46 GMT

@AkosBakos Yes but as below

Original Src: 172.16.16.0/24

Original Dest: 192.168.25.1/32

Translated Src: 10.10.15.2

Translated Dest : Original

The checkpoint throws an error "Invalid object in source of address translation rule # The range size of Original and Translated column must be the same."

The original source is network subnet /24 and the Translated source is single host.

Re: Many to One NAT

AkosBakos — Thu, 19 Dec 2024 14:01:34 GMT

Did you choose hideNAT?

Can you show a screenshot of the rule?

Re: Many to One NAT

the_rock — Thu, 19 Dec 2024 14:04:03 GMT

As @CaseyB make it hide nat, or to overcome it, maybe use address range, that usually works.

Andy

Re: Many to One NAT

Ihenock1011 — Thu, 19 Dec 2024 14:04:56 GMT

@CaseyB How do I do that. My understanding is HIDE NAT will hide behind the gateway or specific address. However mine is it will destined to a host IP

Re: Many to One NAT

AkosBakos — Thu, 19 Dec 2024 14:07:08 GMT

Hi @Ihenock1011

It should work:

Akos

Re: Many to One NAT

the_rock — Thu, 19 Dec 2024 14:08:29 GMT

Let me test this in the lab now and I will send you a screenshot.

Andy

Re: Many to One NAT

AkosBakos — Thu, 19 Dec 2024 14:10:05 GMT

Andy, check my screenshot. It works wit /32 and with simple host object as well.

Re: Many to One NAT

the_rock — Thu, 19 Dec 2024 14:11:00 GMT

I did check it, but thats NOT how @Ihenock1011 wants it lol

Let me see if I can make it work how he described.

Andy

Re: Many to One NAT

Ihenock1011 — Thu, 19 Dec 2024 14:11:30 GMT

@AkosBakos @the_rock @CaseyB I just saw the red H sign under the translated Source and and just right click on it and on the translated source NAT Method to Hide works I didn't know this before Thank you guys you are a real life saver.

Re: Many to One NAT

AkosBakos — Thu, 19 Dec 2024 14:13:24 GMT

You are welcome!

Re: Many to One NAT

the_rock — Thu, 19 Dec 2024 14:17:44 GMT

Great! Btw, I did try with address range, but complained about the same, so guys were 100% right, you have to use hide nat.

Glad you got it.

Andy