topic Re: Using Cluster Object in NAT rules in Firewall and Security Management https://community.checkpoint.com/t5/Firewall-and-Security-Management/Using-Cluster-Object-in-NAT-rules/m-p/257808#M50541 <P>Hey mate,</P> <P>Did you end up figuring this out?</P> <P>Best,</P> <P>Andy</P> Sat, 20 Sep 2025 00:30:10 GMT the_rock 2025-09-20T00:30:10Z Using Cluster Object in NAT rules https://community.checkpoint.com/t5/Firewall-and-Security-Management/Using-Cluster-Object-in-NAT-rules/m-p/257302#M50421 <P>Hello, I used the Cluster object in the NAT rules but the traffic is only NATed to the primary Cluster IP and not to the outgoing Cluster IP. What did I do wrong here?&nbsp;</P> Mon, 15 Sep 2025 17:56:09 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Using-Cluster-Object-in-NAT-rules/m-p/257302#M50421 Mahajem 2025-09-15T17:56:09Z Re: Using Cluster Object in NAT rules https://community.checkpoint.com/t5/Firewall-and-Security-Management/Using-Cluster-Object-in-NAT-rules/m-p/257305#M50423 <P>What version of code are you running on your SMS/MDS?</P> Mon, 15 Sep 2025 19:18:31 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Using-Cluster-Object-in-NAT-rules/m-p/257305#M50423 AaronCP 2025-09-15T19:18:31Z Re: Using Cluster Object in NAT rules https://community.checkpoint.com/t5/Firewall-and-Security-Management/Using-Cluster-Object-in-NAT-rules/m-p/257306#M50424 <P>If you have a failover, things that rely on that rule will NOT work, as new active member would not be associated with it.</P> <P>Andy</P> Mon, 15 Sep 2025 19:19:24 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Using-Cluster-Object-in-NAT-rules/m-p/257306#M50424 the_rock 2025-09-15T19:19:24Z Re: Using Cluster Object in NAT rules https://community.checkpoint.com/t5/Firewall-and-Security-Management/Using-Cluster-Object-in-NAT-rules/m-p/257313#M50425 <P>By default, all traffic from cluster member is translated to VIP of cluster and going over active member (from standby over sync interface to active member).</P> <P>You can use "no-NAT" rules to force cluster members to use their physical IP instead of cluster VIP.</P> Mon, 15 Sep 2025 20:16:09 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Using-Cluster-Object-in-NAT-rules/m-p/257313#M50425 JozkoMrkvicka 2025-09-15T20:16:09Z Re: Using Cluster Object in NAT rules https://community.checkpoint.com/t5/Firewall-and-Security-Management/Using-Cluster-Object-in-NAT-rules/m-p/257317#M50428 <P>Thats actually really good idea, no-nat, agree.</P> <P>Andy</P> Mon, 15 Sep 2025 21:15:31 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Using-Cluster-Object-in-NAT-rules/m-p/257317#M50428 the_rock 2025-09-15T21:15:31Z Re: Using Cluster Object in NAT rules https://community.checkpoint.com/t5/Firewall-and-Security-Management/Using-Cluster-Object-in-NAT-rules/m-p/257808#M50541 <P>Hey mate,</P> <P>Did you end up figuring this out?</P> <P>Best,</P> <P>Andy</P> Sat, 20 Sep 2025 00:30:10 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Using-Cluster-Object-in-NAT-rules/m-p/257808#M50541 the_rock 2025-09-20T00:30:10Z