topic Re: Problem with NAT and ISP in General Topics

Problem with NAT and ISP

Oliver_222 — Wed, 14 Jun 2023 08:03:42 GMT

Good afternoon.

We have ISP1 and ISP2 configured on the security gateway.
We also have NAT rules configured.
ISP1 uses the external address of the Security Gateway. And ISP2 uses 4 addresses: one external from the Security Gateway and 3 not on the gateway. Proxy ARP is configured for these 3 external addresses.

For some reason, with problems with one ISP, encountered the following situation:
1. The default route changes correctly (switches to the gateway of the desired ISP).
2. NAT rules are not working. The NAT rule above (E.g.: ISP1 was working and become unreachable, then the route is changed to ISP2. BUT the NAT rule works for ISP1 because it is upstream to ISP2).

To solve the NAT problem, we modified the NAT rules according to sk174197. We added RNGX objects. Here is how it worked: we had the same rules with RNGX1 and the rule was repeated for RNGX2.
NAT started working correctly (the addresses were hiding behind the right address, according to the automatic rule). But for some reason NAT didn't work for one subnet (there was no NAT in the logs, the checkpoint traffic let through) and the servers on that subnet didn't have Internet access.

Can you tell me what could be the problem?

Re: Problem with NAT and ISP

PhoneBoy — Wed, 14 Jun 2023 18:23:15 GMT

Version/JHF of the gateway in question? (Or if it's an SMB, the firmware version)
Please explain what is meant by "the NAT rule works for ISP1 because it is upstream to ISP2)."
Also, showing the exact rules used would be helpful.
Can you also provide a simple network diagram?

Re: Problem with NAT and ISP

Oliver_222 — Fri, 16 Jun 2023 11:43:32 GMT

R81.10 JHF Take 55
3800 Appliance.
When we shut down one ISP, the NAT rule worked the same and users and servers had no access to the internet. But when we raised ISP2 higher than ISP1, the NAT rule worked for ISP2 and there was internet access (picture 1).
Setting NAT with RNGX (picture 2) - in this case everything worked correctly (as I think), the default route was changed to another provider, in the logs addresses were hidden behind the same provider. But only the subnet 172.16.0.0/24 didn't have Internet working.

Re: Problem with NAT and ISP

PhoneBoy — Fri, 16 Jun 2023 19:16:52 GMT

I recommend engaging the TAC here: https://help.checkpoint.com

Re: Problem with NAT and ISP

CheckPointerXL — Tue, 27 Jun 2023 08:34:02 GMT

did you fix the problem? i'm interested in a similar scenario

Re: Problem with NAT and ISP

Oliver_222 — Tue, 27 Jun 2023 08:53:45 GMT

We are currently investigating the problem together with the TAC