topic Re: Validate the Manual NAT and access control policy rules in Firewall and Security Management

Validate the Manual NAT and access control policy rules

yeruel — Wed, 01 Jan 2025 07:01:06 GMT

Hello Checkmates,

I want your expert experience to validate the below Manual NAT and access control policy format.

I want internet users can access our internal server with the public IP_A, Is the below format valid? I am using the same public IP for others servers with different services ports, that's why i am using Manual NAT.

Manual NAT and Access control policy rule matching
1	NAT rule
name	Original source	original Destination	Translated destination
AAAirport	any	Public IP_A	Private IP_A
2	Access control policy
Name	Source	Destination
Access_AAAirport	Any	Public IP_A

Re: Validate the Manual NAT and access control policy rules

AkosBakos — Wed, 01 Jan 2025 08:55:13 GMT

Hi,

If I were you I would differentiate the NAT rules per service port. This allow you to handle the rules furthermore separately.

I usually follow this attitude.

But should work what you asked.

Akos

Re: Validate the Manual NAT and access control policy rules

Lesley — Wed, 01 Jan 2025 10:06:01 GMT

Would indeed also recommend to make the rule more specific with a port like for example tcp443

Also make sure if needed proxy arp is in place for the public IP. Firewall needs to know the public IP belongs to him.

Unless the public IP is in the topology itself of the firewall (configured direct on a interface)

Best way to test if arp works correct is to see traffic logs, if you see traffic towards the public IP you know arp works.

Re: Validate the Manual NAT and access control policy rules

yeruel — Wed, 01 Jan 2025 10:07:51 GMT

Hi @AkosBakos

I understand, I did different rule1 , rule2 , rule 3 to map the same public IP with private ip differently according to the services port. the above one is just for rule1, I did the same for others rules. So the above NAT rule and access rules format is valid. Right?

Re: Validate the Manual NAT and access control policy rules

AkosBakos — Wed, 01 Jan 2025 10:11:32 GMT

Hi @Lesley

I seems, only one Public_IP relevant here, so proxy ARP is not relevant (yet)

Yes, access rules are recommended to separate too.

Akos

Re: Validate the Manual NAT and access control policy rules

AkosBakos — Wed, 01 Jan 2025 10:31:11 GMT

Hi @yeruel

I suggest you one-to-one correspondence. One NAT rule belogs to one Access rule. This is the best way.

Akos

Re: Validate the Manual NAT and access control policy rules

yeruel — Wed, 01 Jan 2025 10:35:54 GMT

Hi @Lesley @AkosBakos

1. for access rules, destination will be public IP_A?

2. If we have more than one public IP for example

213.66.95.13---External gateway interface
213.66.95.10---will be used for Hide NAT IP address
213.66.95.11, 12 will be used to publish servers for accessing from internet.

213.66.95.10,11,12 are added in the ARP gaia portal.

ARP 213.66.95.10, 213.66.95.11, and also 213.66.95.12 in the arp with real ip address 213.66.95.13 and outside interface.

Any advice please?

Re: Validate the Manual NAT and access control policy rules

AkosBakos — Wed, 01 Jan 2025 14:10:27 GMT

Hi @yeruel

"213.66.95.10,11,12 are added in the ARP gaia portal" -> don't forget to add to all members this enties (both cluster members)

The guide is here: https://support.checkpoint.com/results/sk/sk30197

---I deleted my sentence, my wording was misleadning---

Akos

Re: Validate the Manual NAT and access control policy rules

Lesley — Wed, 01 Jan 2025 12:19:50 GMT

As long as you see the traffic in the logs (allowed or blocked) you know config is correct on arp level.

1. for access rules, destination will be public IP_A? - correct