STATIC NAT in Azure Checkpoint

[upendras]

How to configure Static NAT (Bi-directional)  and Outbound NAT (Source NAT) in Azure Checkpoint.

I have 3 VMs and want to send outbound traffic towards internet each with unique public IP. how can we configure such type of NAT in Azure checkpoint point.

Thanks

Upen

[Matthias_Haas · Accepted solution]

Hi Upen,

are  you using a Single Gateway ?

In this case you could use additional public/private IPs on the external Interface (eth0) of the FW:

and do the Source NAT for each vm on the FW  (to the Private IP, Azure in return is then NATing to the Public IP)

At least a outbound NAT is possible in this case.

Matthias

[upendras]

I have cluster in Azure.. and want to outbound NAT like VM private IP 10.1.1.1 go to Internet, it will be NATTed with 1.1.1.1

please help me suggest how can I achieve this...

Thanks

Upen

[yunier88]

Hello there,
In my case I need to know how to add a new public IP in my FW to be used by my prod Vnet in outbond. Currently all my VNETS (backend) when they go to the internet use the same public IP. But in my environment I need the Prod VNET to use a different public IP than the rest of the other Vnets. Somebody could help me? Thanks

[Nir_Shamir]

Hi,

I know that if you remove the Public IPs from the instances themselves (not the VIP) then the GWs will go out via the Frontend LB and then you can create an Outbound NAT rules on the Frontend LB with a different PIP which is allocated on the Frontend LB

[yunier88]

Hello there,

Do you have an example of the necessary rules to create in the Firewall and in the Load Balancer?

Thanks

[Nir_Shamir]

usually the frontend-lb is created with an example rule you can copy. the Firewall NAT rules can be seen our admin guide:

https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_IaaS_HighAvailability_for_...

[yunier88]

Just to be sure, this information that you share with me is for outbond traffic. Since in my case I already managed to carry out inbound traffic with an LB. Thanks

[Nir_Shamir]

no, that's for Inbound traffic.

For outbound you need to create outbound NAT rules on the Fronend-LB.

[yunier88]

Hello there,

Do you know where I can find some configuration example?

Thanks

[Nir_Shamir]

I don't know if there are examples some where but the procedure is like this:

1) remove the PIPs from the Cluster members.

2) add a NAT rule which hides you specific traffic behind the cluster members external IP (Dynamic object named 'LocalGatewayExternal'

3) create an Outbound rule on the Frontend-LB behind a specific Frontend PIP for your specific traffic. 

all the traffic that equals to that rule will be hidden behind the Frontend-LB PIP and not the Cluster VIP.

[yunier88]

Hello there,

In my case it is a single gateway. The procediment will be the same?

On the other hand when you say: 1) remove the PIPs from the Cluster members.
In my case I cannot delete my only public IP from the Gateway, it is used for S2S and P2S VPN connection. Please can you explain in more detail?

Thanks

[Nir_Shamir]

On a single gateway it's much more easier.

you can add a secondary private IP on the external interface of the Gateway (usually eth0) and attach to it a new PIP.

then in the rule base you do Source-NAT on your specific server and hide it behind the new Private IP you added.

From there it will be hidden behind the new PIP. 

[yunier88]

Thanks, I'll try that solution

[Danimax007]

Hello Nir,

If we remove the PIP assigned to each cluster member, how do we connect to the individual cluster members through ssh and https when they are managed from the external interface.

Is this the only solution for cluster cloudguard setup?

Looking forward to your feedback.

[bmomartins]

Hello @Matthias_Haas,

That will not work for an HA cluster, since that from Azure side you'll not be able to assign the same Public IP object to two different network interfaces.

How can we bypass this?

Cheers!

[Nick_Mandafouni]

Is there any resolution to this?  How do we fix this on an HA Cluster ?

Thanks

[yunier88]

Hello there,

In this solution you provide. Is it necessary to change something in the routing of the FW? So that the main public IP (created by default) remains the IP for S2S and P2S VPN and Hide nat?

Thx

[PhoneBoy]

For VPN to work in this situation, you'll probably have to adjust the Link Selection setting in the relevant gateway object to use the public IP.

[yunier88]

Hi,

Here I share a screenshot of my configuration in Link selection settings. Do you think the configuration is correct for the main public IP (created by default) remains the IP for S2S and P2S VPN and Hide nat? The ip you see in the screenshot 52xxxxxx is my main public IP.
Do you think that with this configuration there is no problem when I create other public IPs in the eth0 interface of my FW?

Thank you

[PhoneBoy]

Yes this is how you’d configure it.

[AndyS]

A question regarding @yunier88 @PhoneBoy @Nir_Shamir , initial question; After adding an in Azure Portal Secondary Static Private IP with a Public IP, should the Network Interface panel in the WebUI browser; should we see an alias with its new Private IP and Public IP? Or do we need to manually add in the WebUI this Private and Public IPs?

[yunier88]

Thanks so much!!

[yunier88]

A question @PhoneBoy  @Nir_Shamir  regarding , initial question; After adding in Azure Portal a Secondary Static Private IP with a Public IP, should the Network Interface panel in the WebUI browser; should we see an alias with its Private IP and Public IP? Or do we need to manually add an alias to eth0 with a Public IP in the WebUI, generated in the Azure "IP configuration" of gaia NIC?

Thanks

[PhoneBoy]

In general, this is not necessary, so long as you have the appropriate rules in place to deal with that specific IP.