topic NAT on gateway itself for IKE traffic in Firewall and Security Management

NAT on gateway itself for IKE traffic

asaivephac — Fri, 17 Jan 2025 13:51:37 GMT

Hi,

We have a new service provider that we're connected to and their GW is 172.16.0.1/29, on their end they forward all the public network traffic (/28) to the Checkpoint VIP(172.16.0.2/29) and we perform all NAT on our end.

We have hide behind NAT configured on our network objects and that's all working great but the IKE traffic is generated by the gateway itself so it's not getting NAT translation so the provider sees the VIP address and can't route it.

Is there a way to NAT the Gateway itself so IKE appears as a NAT address instead of the 172.16.0.2/29 private interface VIP?

Any thoughts how this can be accomplished?

Re: NAT on gateway itself for IKE traffic

AlekzNet — Fri, 17 Jan 2025 14:33:47 GMT

Which device has a public IP-address?

NAT-T should take care of IKE with NAT.

Re: NAT on gateway itself for IKE traffic

asaivephac — Fri, 17 Jan 2025 14:46:43 GMT

The provider FW has public IP-address and has a rule to forward everything to our VIP and we manage our own NAT translation.

If I were to put a manual NAT-t entry for (CP VIP) 172.16.10.2 > NAT, would the ipsec tunnel use the nat address? I'm not sure if Nat-T is before or after VPN.