topic Re: Smartconsole with NAT to the manager doesnt work in General Topics

Smartconsole with NAT to the manager doesnt work

Ryan_Ryan — Thu, 10 Sep 2026 00:17:56 GMT

Using R82 we have an issue connecting to our smart console via an OOB connection.

Whilst within the customer network connecting to smart console using the management server's real IP address works fine, however in case of a terminal server failure or the like we have a backup link into each customer and we nat every IP address.

When we connect with Smart console to the NAT IP, the login works (bad password throws a bad password etc) we also get a warning if existing session is open etc, but then it will promptly stop with "Internal Error" (Web access and SSH with NAT work fine)

CPD says:

ERROR management.object_store.ObjectStoreSessionImpl [qtp-465201630-50029]: Failed to find domainIp 10.10.10.5

Where 10.10.10.5 is the NAT IP we enter in Smartconsole, at a network level the manager knows nothing of this address and shouldn't see it. Our same setup used to work in R81.10, but is broken is R82 and R81.20

Re: Smartconsole with NAT to the manager doesnt work

Chris_Atkinson — Thu, 10 Sep 2026 00:39:08 GMT

Have you followed this or some other approach?
https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SecurityManagement_AdminGuide/Content/Topics-SECMG/Security_Management_behind_NAT.htm

Re: Smartconsole with NAT to the manager doesnt work

Ryan_Ryan — Thu, 10 Sep 2026 00:54:13 GMT

I haven't tried it, I did look at it but I believe that scenario is for gateways connecting to their manager via NAT, this is purely the operator connecting via smart console behind NAT. ideally the manager never would see this faked IP, its un-nated before it gets there, but it seems to send it as part of a potential MDS domain lookup.