topic Re: Configure NAT port for Remote Access VPN & Mobile Access in SASE and Remote Access

Configure NAT port for Remote Access VPN & Mobile Access

MarcuzShinz — Wed, 24 Jul 2024 04:40:57 GMT

Hi Guy!

Currently I have some confusing problems as follows:

1. I am configuring Remote Access on Check Point with Public IP set on Peplink and we change from port 443 -> 8443. This means that Peplink is configuring NAT as follows:

Public IP:8443 -> Check Point:8443
In addition, on Peplink there is also NAT port UDP 4500 & 500 for IPsec.

And this works fine.

2. When we enabled blade Mobile access, the Visitor Mode was forced to change back to 443, and we changed the configuration on Peplink to:
Public IP:8443 -> Check Point:443

However, at this time, Remote Access does not work. I'm not sure what the difference is here. Because it still runs over IPsec. But Mobile Access work ok!

Am I missing any other configuration on Checkpoint?

Re: Configure NAT port for Remote Access VPN & Mobile Access

PhoneBoy — Wed, 24 Jul 2024 14:43:55 GMT

Unfortunately, if you are using Mobile Access Blade, this is expected behavior.
See: https://support.checkpoint.com/results/sk/sk107852

Re: Configure NAT port for Remote Access VPN & Mobile Access

MarcuzShinz — Thu, 25 Jul 2024 01:30:22 GMT

I understand your point, about mobile access using port 443, and we did that and it worked as expected. However, what about remote access? I don't know why when I change the NAT in peplink device to "Public IP:8443 -> Check Point:443", the remote access doesn't work anymore.

Re: Configure NAT port for Remote Access VPN & Mobile Access

PhoneBoy — Thu, 25 Jul 2024 13:08:40 GMT

The VPN client expects to use the Visitor Mode port, which is locked to port 443 because you are using Mobile Access Blade.

Re: Configure NAT port for Remote Access VPN & Mobile Access

MarcuzShinz — Thu, 25 Jul 2024 13:25:53 GMT

Currently I have tried, without enable on mobile access, but still configuring NAT according to "Public IP:8443 -> Check Point:443", remote access also does not work.

I see that only when we config NAT with "Public IP:8443 -> Check Point:8443 or Public IP:443 -> Check Point:443" does it work. Just need the port mapping to be the same and it will work.

But I'm not clear because Remote Access on window is IPsec, what does it have to do with 443 or 8443?

Re: Configure NAT port for Remote Access VPN & Mobile Access

PhoneBoy — Thu, 25 Jul 2024 20:37:09 GMT

Even with an IPsec client, HTTPS is used on initial connection to the Visitor Mode port.
This is by design.

Re: Configure NAT port for Remote Access VPN & Mobile Access

MarcuzShinz — Fri, 26 Jul 2024 12:06:47 GMT

Dear PhoneBoy,

I mean as image below

Re: Configure NAT port for Remote Access VPN & Mobile Access

PhoneBoy — Fri, 26 Jul 2024 17:21:14 GMT

That is precisely how I understood the situation.
Doesn't change the answer, unfortunately.
You can try just deleting and recreating the VPN site with the port number 8443: https://support.checkpoint.com/results/sk/sk103107
However, unless you change the Visitor Mode port to match, this may not work.

Re: Configure NAT port for Remote Access VPN & Mobile Access

MarcuzShinz — Tue, 30 Jul 2024 07:10:12 GMT

I solved this, with Public IP:8443 <-> Checkpoint:443
Thanks for your help.

Re: Configure NAT port for Remote Access VPN & Mobile Access

PhoneBoy — Tue, 30 Jul 2024 14:06:21 GMT

How exactly did you solve it?
By deleting/readding the site using port 8443?

Re: Configure NAT port for Remote Access VPN & Mobile Access

MarcuzShinz — Wed, 31 Jul 2024 04:39:54 GMT

Dear PhoneBoy,

Not sure what the error is, I tried adding 1 Nat rule and Firewall Rules as below and it worked.

Re: Configure NAT port for Remote Access VPN & Mobile Access

PhoneBoy — Wed, 31 Jul 2024 21:46:04 GMT

No screenshot?

Re: Configure NAT port for Remote Access VPN & Mobile Access

MarcuzShinz — Thu, 01 Aug 2024 14:43:48 GMT

Re: Configure NAT port for Remote Access VPN & Mobile Access

PhoneBoy — Thu, 01 Aug 2024 16:17:00 GMT

Considering the gateway shouldn't even see the public IP here (if I'm understanding your topology correctly), I'm surprised it works.
Can you confirm how the gateway sees the traffic with a tcpdump/fw monitor?

Re: Configure NAT port for Remote Access VPN & Mobile Access

MarcuzShinz — Thu, 01 Aug 2024 16:21:46 GMT

I think cause in the link selection, I have choosen option Nat-t and enter public IP into it. because I'm using s2s and c2s the same public IP

Re: Configure NAT port for Remote Access VPN & Mobile Access

mohammed1987 — Sat, 04 Apr 2026 20:25:38 GMT

Hi,

try while executing wizard VPN and when typing the server address or name add the port number like 10.10.10.254:8443

Re: Configure NAT port for Remote Access VPN & Mobile Access

mohammed1987 — Sat, 04 Apr 2026 20:46:14 GMT

Hi,

what i have done,

on smartconsole :

- Deactivate Mobile Access Blade

- Create a new tcp service let say https_VPN_RA as a https protcol listening on 18443

- On the VPN Clients tab, Remote Access, activate "support mode visitor" and choose the service created above.

- publish and install.

On client side, i do some wireshark capture and i see the first https request generated from Mobile client VPN with port number 18443.

Let us know if it works for you.

A+

Re: Configure NAT port for Remote Access VPN & Mobile Access

mohammed1987 — Sat, 04 Apr 2026 20:47:47 GMT

i also on the client side type the server address or name with the port 18443 let say like 10.10.10.254:18443