topic Re: How to disable NAT from VIP to Gateway when trying to ping GW? in General Topics

How to disable NAT from VIP to Gateway when trying to ping GW?

Mahajem — Wed, 05 Jun 2024 14:48:41 GMT

Hello, I need to ping from a monitoring server to our CP GW physical IP but when I checked the logs I found out that only the VIP is replying and NATed to the active GW member. When I try to ping the GW physical IP it does not work but pinging to standby members physical IP is working. Can anyone help me? Do I need to manipulate the table.def with no_hide_services_ports = { <0,1>}? Is it possible to do this change only for the monitoring servers IP address and why is standby IP not NATed?

It shows me XLATE Destination IP (IP from active GW member)

NAT Rule number 0

Dst Port 0

Src Port 0

Re: How to disable NAT from VIP to Gateway when trying to ping GW?

PhoneBoy — Thu, 06 Jun 2024 01:57:41 GMT

What version/JHF is the gateways?
Did you also check: https://support.checkpoint.com/results/sk/sk34180

Re: How to disable NAT from VIP to Gateway when trying to ping GW?

Mahajem — Thu, 06 Jun 2024 08:38:36 GMT

R81 JHF T92, yes I also saw this sk but where are the difference between editing table.def and this workaround? And why does the standby not using the VIP?

Re: How to disable NAT from VIP to Gateway when trying to ping GW?

PhoneBoy — Thu, 06 Jun 2024 14:31:56 GMT

If the standby uses the VIP, the traffic would have to be communicated through the primary (which owns the VIP).

The SK I referred to modifies the behavior for all traffic on the specific gateway, whereas I believe the table.def modifications are more focused to specific types of traffic and apply to all gateways.
However, if you manage gateways of different versions, table.def changes need to be made multiple places.
They also need to be made again on an upgrade.

Re: How to disable NAT from VIP to Gateway when trying to ping GW?

the_rock — Thu, 06 Jun 2024 14:41:44 GMT

I also have a gut feeling sk Phoneboy gave is your best option, but you can verify with TAC if there might be better option.

Personally, I doubt it...

Andy