topic Re: NAT Space Routed to Interface in General Topics

NAT Space Routed to Interface

love-cw — Thu, 28 Jan 2021 23:07:54 GMT

I worked at a large Check Point Customer where we would set up a NAT Subnet by routing the subnet from the router to the firewall's vip. I would like to use this technique as we are running out of addresses on the interface in question. What else do I need to do to make this work?

Cheers

Re: NAT Space Routed to Interface

Maarten_Sjouw — Fri, 29 Jan 2021 07:29:32 GMT

All you need to do is make sure the subnet is routed to the gateway, then you have the complete subnet at your proposal including network and broadcast address. On the Check Point just use the addresses, nothing else is needed, no proxy arp or anything else.

Re: NAT Space Routed to Interface

Chris_Atkinson — Fri, 29 Jan 2021 10:42:51 GMT

There are several reasons that I prefer this approach, least of which is removing the dependency on proxy-arp.

I find it more flexible in terms of routing and your ISP link addressing etc.