topic Re: NAT not able to access from internal network in Spark Firewall (SMB)

NAT not able to access from internal network

jcs001 — Sat, 06 Apr 2019 07:30:24 GMT

Hi,

I have a question about setting up NAT on checkpoint 450.

So after I used the wizard on "Active Devices", save as a machine to "server". I was able to connect to the server from external network. However, from within the network, I am unable to.

Here's some more of the settings I set:

Access - All Zones

NAT - Hide behind gateway.

Any pointers?

Thanks!

Re: NAT not able to access from internal network

PhoneBoy — Sat, 06 Apr 2019 17:55:39 GMT

I assume you mean a 750, which is an SMB appliance.

In your server object, did you check the option under Advanced?

Re: NAT not able to access from internal network

jcs001 — Sat, 06 Apr 2019 19:36:03 GMT

Yes that was checked but still didn't work

Re: NAT not able to access from internal network

PhoneBoy — Sat, 06 Apr 2019 23:33:31 GMT

Have you done a tcpdump to see what the traffic looks like?

I suspect you'll have to get the TAC involved.

Re: NAT not able to access from internal network

jcs001 — Tue, 09 Apr 2019 06:57:28 GMT

Hi,

I think i figured it out. I think there's a UI bug somewhere.

If you create your server node from the "active device" page, I believe the routes are configured differently when you create the server node from the actual server page. After multiple attempts, if I create the server object from the actual server page, it works.

Bug?

Re: NAT not able to access from internal network

G_W_Albrecht — Tue, 09 Apr 2019 14:17:11 GMT

How could you do that ? On my 730, Home > Monitoring > Active Devices has no option to add a server, and neither has Logs & Monitoring > Status > Active Devices ...

Re: NAT not able to access from internal network

PhoneBoy — Tue, 09 Apr 2019 17:10:37 GMT

Possibly, and you should engage the TAC with this.

Re: NAT not able to access from internal network

PhoneBoy — Tue, 09 Apr 2019 17:14:28 GMT

Right-click on the object in the Active Devices view, choose Save-As > Server.

Re: NAT not able to access from internal network

G_W_Albrecht — Wed, 10 Apr 2019 11:43:02 GMT

I second that 😉

Re: NAT not able to access from internal network

G_W_Albrecht — Thu, 11 Apr 2019 07:06:25 GMT

Do you have a response from TAC yet ?

Re: NAT not able to access from internal network

G_W_Albrecht — Thu, 11 Apr 2019 07:09:00 GMT

@PhoneBoy wrote:

Right-click on the object in the Active Devices view, choose Save-As > Server.

I see - i can not do that, also not from menue, as this is only possible for IPs without defined objects. Definitely a bug, this feature should make defining servers more handy but actually makes servers partly unusable...

Re: NAT not able to access from internal network

PhoneBoy — Thu, 11 Apr 2019 15:26:16 GMT

It makes sense in some ways because in both cases, you are defining an object (one a host, another a server).
I suppose what would be a nice addition would be a way to convert from one to the other.