topic Re: How can i create a SNAT Pool (Specific public IPs) with ISP redundancy in Firewall and Security Management

How can i create a SNAT Pool (Specific public IPs) with ISP redundancy

Wing_Chow — Fri, 23 Aug 2019 04:57:37 GMT

Hi all,

I've been looking for SK to talk about how to configure a Hide NAT with specific Public IPs in ISP Redundancy. I mean how to can i create a outbound traffic with a Hide NAT pool (Specific IP for each ISP) not Gateway IP address.

I've been searching in history of GAIA OS from R76 to R80.30. I cannot see that this feature have been added.

For example:

Email Servers: When we have a this scenario to load balanced a SMTP traffic, always need to respond from the same source for inbound and outbound. When we have a ISP Redundancy, the concepts to configure a ISP Redundancy are:

- To have redundance of services in most cases SMTP Traffic inbound and outbound for each ISP Public.

I know that Check Point is not a Load Balancer but at least need to have this feature because the only outbound load balancer is the Gateway IP Address.

Any information or SK or future feature in R80.40 and above, please let me know i will appreciate it.

Regards,

Re: How can i create a SNAT Pool (Specific public IPs) with ISP redundancy

Wolfgang — Fri, 23 Aug 2019 06:41:52 GMT

Wing_Chow,

if you are using ISP redundancy in LoadSharing mode both ISP links are used for outgoing connections.

Regarding the hide NAT, the default behaviour is to hide NAT the connection behind the outgoing interface.

You must define an automatic hide NAT on the network- or host-object, select "hide behind gateway" and set your gateway with the ISP redundancy as install on target. You don't have to specify an IP-address in the NAT configuration.

And you can't use the automatic NAT-configuration on the gateway. Option "hide internal networks behind gateways" is not supported with ISP redundancy in LoadSharing mode.

With this configuration outgoing packets via ISP-A are hide NATed behind the interface of ISP-A and outgoing packets via ISP-B are hide NATed behind the interface of ISP-B.

Wolfgang

Re: How can i create a SNAT Pool (Specific public IPs) with ISP redundancy

Eli_Faskha — Fri, 23 Aug 2019 15:20:26 GMT

Try this:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk25152

Static NAT fails for outgoing connections through gateway with ISP Redundancy in Load Sharing mode

It includes the use of dynamic objects to figure out which interface the connection goes through, but it should work...

Re: How can i create a SNAT Pool (Specific public IPs) with ISP redundancy

Wing_Chow — Fri, 23 Aug 2019 17:13:34 GMT

Hi Eli_Faskha,

I have Tested for inbound and outbound and working good.

Thanks a lot.

Regards,