topic Re: NAT Priority In Checkpoint R80.40 in General Topics

NAT Priority In Checkpoint R80.40

LostBoY — Wed, 22 Sep 2021 09:28:12 GMT

I have a Checkpoint Geo-Cluster in Active-Active Mode in AWS.. i need to setup outbound NAT for a webserver..WAN IP/Elastic IP of that server will be whitelisted at the remote site.

The issue here is i dont want to use NAT (hide behind Gateway) for outbound communication as in that case i have to share external ip of my GW.. i created a secondary IP in AWS for this Gateway and mapped an elastic ip with it..is there any way i can make Checkpoint take the secondary elastic IP while using hide behind Gateway NAT ? hide behind IP wont work here as its an Active-Active Cluster where one member handles traffic at a time..if i use hide behind ip ..outbound communication will fail if traffic switches to secondary device.

Pls advice..

Re: NAT Priority In Checkpoint R80.40

PhoneBoy — Wed, 22 Sep 2021 14:40:56 GMT

You could try to use a Dynamic Object here, which is a sort of placeholder object.
This would go in the translated source of a manual NAT rule.
You would use the dynamic_objects CLI command on each gateway to set it to the correct value.

Re: NAT Priority In Checkpoint R80.40

LostBoY — Wed, 22 Sep 2021 16:03:35 GMT

thanks for the reply.. i referred an article on Dynamic Objects which states to create Dynamic Objects and then define values by clicking on the Gateways and going in Dynamic Object section.. however, i cudnt find dynamic object tab when i double click on GWs.. i m using R80.40 Cluster.

Is this limited to other version ?

Re: NAT Priority In Checkpoint R80.40

LostBoY — Wed, 22 Sep 2021 16:06:06 GMT

Ok .. so i think i need to enable smartprovisioning before using Dynamic Objects.. is it a licensed feature ? license is required for Mgmt Server and all GWs it manages ?

Re: NAT Priority In Checkpoint R80.40

PhoneBoy — Wed, 22 Sep 2021 16:10:44 GMT

Dynamic Objects have existed for quite some time.
You create them here:

Think of it as a "placeholder" object you can use with the actual definition defined on the security gateway itself via the CLI.
More details here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=skI1915

Re: NAT Priority In Checkpoint R80.40

PhoneBoy — Wed, 22 Sep 2021 16:22:46 GMT

SmartProvisioning generally requires a license.
However, they are not required for the use of Dynamic Objects.

Re: NAT Priority In Checkpoint R80.40

LostBoY — Wed, 22 Sep 2021 16:25:26 GMT

Ok.. but how do i setup dynamic objects without smartprovisioning ? i am able to create dynamic objects fro mSmartconsole but i cudnt get to assigning values to created DO

Re: NAT Priority In Checkpoint R80.40

PhoneBoy — Wed, 22 Sep 2021 16:41:26 GMT

The configuration for the values of the Dynamic Objects is done via the CLI as described in the SK I linked to.