topic Re: Can't use groups with exclusion in NAT rules in R80? in SmartMove

Can't use groups with exclusion in NAT rules in R80?

mhurst — Wed, 04 Mar 2020 03:00:12 GMT

In R80 can you not use groups with exclusion in NAT rules?

In a ruleset imported from R77 - where it has verified OK for years - am getting multiple verification errors:

Invalid Object 'XXXXX' in Original Source of Address Translation Rule 195. The valid objects are: host, gateway, network, address range and router.

The original source in that rule is a group with exclusion. Is that no longer supported?

Re: Can't use groups with exclusion in NAT rules in R80?

mhurst — Wed, 04 Mar 2020 03:07:26 GMT

The valid objects are: host, gateway, network, address range and router.

Groups are not listed as valid objects at all in that verify message.

Re: Can't use groups with exclusion in NAT rules in R80?

PhoneBoy — Wed, 04 Mar 2020 03:44:05 GMT

This was never formally supported.
The fact that it worked at all in prior releases is considered a bug that has since been fixed.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk97246

Re: Can't use groups with exclusion in NAT rules in R80?

mhurst — Wed, 04 Mar 2020 04:08:23 GMT

Thanks for the prompt response.

Re: Can't use groups with exclusion in NAT rules in R80?

mhurst — Wed, 04 Mar 2020 07:12:30 GMT

It is unfortunate this was categorised as a bug as it is useful functionality.

Applying a NAT rule to a set of things except for a subset of those things is required sometimes.

Re: Can't use groups with exclusion in NAT rules in R80?

PhoneBoy — Wed, 04 Mar 2020 15:51:18 GMT

Understand that it is useful, but you can achieve a similar result with additional "no NAT" rules.

Re: Can't use groups with exclusion in NAT rules in R80?

Lhouse — Mon, 23 Mar 2020 15:15:53 GMT

I try this with our VPN addresses to and internal segment of our LAN and after I push policy I can no longer ping the network the destination network...does anyone have thoughts on that.

Re: Can't use groups with exclusion in NAT rules in R80?

amoruck — Wed, 25 Nov 2020 16:25:06 GMT

But if you use SmartMove tool (sk97246) for Juniper to Check Point conversion, it will happily create NAT rules using groups with exclusion; I think if you decided it's a bug in one place you should not use it in another as a feature (otherwise this tool is very handy, btw, thanks).

Re: Can't use groups with exclusion in NAT rules in R80?

PhoneBoy — Mon, 30 Nov 2020 04:26:08 GMT

That might be a bug in the SmartMove tool.
Paging @yael_haker
I'm actually curious now if rules with negated objects in NAT rules works in R81, since we made major changes to the NAT policy in this version.

Re: Can't use groups with exclusion in NAT rules in R80?

Meital_Natanson — Thu, 03 Dec 2020 16:38:46 GMT

No. In R81, NAT supports domain objects, security zones, updatable objects, access roles, data centers and hit count.

But not negate objects / group with exclusions.

As you wrote before, it can be achieved using no NAT rule.

Re: Can't use groups with exclusion in NAT rules in R80?

Timothy_Hall — Thu, 03 Dec 2020 19:25:41 GMT

Hi @Meital_Natanson is there a way to test NAT rule matching from the CLI gateway similar to fw up_execute for the Firewall/Network policy layer?

Re: Can't use groups with exclusion in NAT rules in R80?

Meital_Natanson — Tue, 08 Dec 2020 08:51:46 GMT

@Timothy_Hall - no such option.

Re: Can't use groups with exclusion in NAT rules in R80?

Ofir_Shikolski — Wed, 09 Dec 2020 10:59:28 GMT

If there are issues with SmartMove - please contact us at sc@checkpoint.com

We will appreciate to get a copy of the config file in order to address this issue