topic Re: Unable to create destination NAT rule for ICMP service in General Topics

Unable to create destination NAT rule for ICMP service

Firewall_Head — Wed, 15 Jan 2025 07:12:10 GMT

Dear Checkmates,

I'm having problem creating DST NAT rule for an ICMP traffic, I'm forced to create a rule with services as "ANY" for this to work.

Can someone let me know if this is a limitation and so please share the relevant document from Check Point.

Thanks in advance!

=======

WR,

Re: Unable to create destination NAT rule for ICMP service

Lesley — Wed, 15 Jan 2025 08:49:20 GMT

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Configuring-NAT-Policy.htm?TocPath=Creating%20an%20Access%20Control%20Policy%7CConfiguring%20the%20NAT%20Policy%7C_____0

NAT (Network Address Translation) is a feature of the Firewall Software Blade

and replaces IPv4 and IPv6 addresses to add more security. NAT protects the identity of a network and does not show internal IP addresses to the Internet.

The Security Gateway can change:

The source IP address in a packet.
The destination IP address in a packet.
The TCP / UDP port in a packet. (ICMP is not TCP or UDP)

Re: Unable to create destination NAT rule for ICMP service

G_W_Albrecht — Wed, 15 Jan 2025 11:18:06 GMT

https://community.checkpoint.com/t5/Management/Destination-NAT-with-ICMP/m-p/19275#M16164

sk66506: ICMP Error packets are not translated according to NAT rulebase

sk172933: NAT FAQ

Re: Unable to create destination NAT rule for ICMP service

PhoneBoy — Wed, 15 Jan 2025 19:49:52 GMT

The NAT rulebase only permits usage of TCP and UDP services.
I don't believe this is explicitly documented as SmartConsole provides an appropriate error when you attempt this configuration.
This is also a long-standing limitation going back to the earliest days of the product.

Having said that, the NAT rulebase only applies if the traffic is permitted by the Access Policy.

Re: Unable to create destination NAT rule for ICMP service

Lesley — Wed, 15 Jan 2025 19:58:02 GMT

You get a validation error when you try to sneak ICMP in a group in the rule. If you try to select icmp itself you cannot find it to select in the drop down menu