Best Practices Managing NAT Rules

[User1234]

Hi!

Managing NAT rules with ansible looks a bit tricky. I already saw the 3 different modules to add, edit and delete rule (rather than having one like the access_rules) and saw the thing that the only identifier for NAT rules is the rule number. As the rule number depends on automatic and manual rules, they are likely to change even if no manual NAT rule is modified.

Does anyone have a working task/playbook to maintain manual NAT rules with ansible? Are there any best practices? Any examples (apart from the micro examples of the documentation)?

[boneyard]

Very good question, anyone with experience since that wants to share?

I'm trying to get it working and will share in another thread some feedback, but it is pretty different from the access policy and other Check Point Ansible modules. Requiring a different approach yet again. Ansible Modules for every vendor require some getting used to, but having to do it in different ways for one product feels like it is not developed for the users.

[Jim_Oqvist · Accepted solution]

Hi,

Starting from R81 API version 1.7 and later we started supporting to use name in the NAT rule which enables us to create a idempotent module for our ansible collection to add, change and delete NAT rules. 

This module has been developed by R&D and is going to be added to Galaxy repository in the next version we release of the collection.

https://github.com/CheckPointSW/CheckPointAnsibleMgmtCollection/blob/master/plugins/modules/cp_mgmt_...

If you want to find an example on how to use it you can find that here:

https://github.com/checkpointsw-devsec/enterprise-automation-poc/blob/main/ansible/roles/chkp-nat-po...

Please note as described in the module the management server needs to have a JHF that addresses PMTR-88097

https://support.checkpoint.com/search#q=PMTR-88097 

[boneyard]

Hi Jim, that is good to read. Do you have an idea when to expect this in the Galaxy repository?

[Jim_Oqvist]

R&Ds plan was if all goes well to release the next collection before end of this Quarter which means end of this week, it might be postponed if any issues are identified during the testing phase.