topic Re: Smartconsole with NAT to the manager doesnt work in General Topics

Smartconsole with NAT to the manager doesnt work

Ryan_Ryan — Thu, 10 Sep 2026 00:17:56 GMT

Using R82 we have an issue connecting to our smart console via an OOB connection.

Whilst within the customer network connecting to smart console using the management server's real IP address works fine, however in case of a terminal server failure or the like we have a backup link into each customer and we nat every IP address.

When we connect with Smart console to the NAT IP, the login works (bad password throws a bad password etc) we also get a warning if existing session is open etc, but then it will promptly stop with "Internal Error" (Web access and SSH with NAT work fine)

CPD says:

ERROR management.object_store.ObjectStoreSessionImpl [qtp-465201630-50029]: Failed to find domainIp 10.10.10.5

Where 10.10.10.5 is the NAT IP we enter in Smartconsole, at a network level the manager knows nothing of this address and shouldn't see it. Our same setup used to work in R81.10, but is broken is R82 and R81.20

Re: Smartconsole with NAT to the manager doesnt work

Chris_Atkinson — Thu, 10 Sep 2026 00:39:08 GMT

Have you followed this or some other approach?
https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SecurityManagement_AdminGuide/Content/Topics-SECMG/Security_Management_behind_NAT.htm

Re: Smartconsole with NAT to the manager doesnt work

Ryan_Ryan — Thu, 10 Sep 2026 00:54:13 GMT

I haven't tried it, I did look at it but I believe that scenario is for gateways connecting to their manager via NAT, this is purely the operator connecting via smart console behind NAT. ideally the manager never would see this faked IP, its un-nated before it gets there, but it seems to send it as part of a potential MDS domain lookup.

Re: Smartconsole with NAT to the manager doesnt work

ZaferGr — Fri, 11 Sep 2026 09:27:26 GMT

Did you configure static NAT through the Smart Console management object??

Re: Smartconsole with NAT to the manager doesnt work

Ryan_Ryan — Mon, 14 Sep 2026 00:49:27 GMT

I am not sure how you mean? you mean static NAT on the check point manager? If so then no, because we don't want any nat between the manager and the firewalls.

if you mean within smart console on the client? I am keen to hear more that seems to be what we need

Re: Smartconsole with NAT to the manager doesnt work

ZaferGr — Mon, 14 Sep 2026 14:50:46 GMT

Hello Ryan,

Maybe we need to sure! Is SmartConsole access to R82 Management Server through DNAT supported?

The fact that the domain/IP identity information used by SmartConsole on the Management Server side is located behind NAT may be causing a problem

Re: Smartconsole with NAT to the manager doesnt work

Ryan_Ryan — Tue, 15 Sep 2026 00:49:50 GMT

Yes that's the question I am wondering. I can say with 100% certainty prior to R82 yes it worked with DNAT, infact it was this exact setup that worked, only thing we did was R82 upgrade.