Cloudguard Hide NAT in Azure

[TOM_MORAN]

Hi want to use 3 x different public ip address for hide nat in Azure.

The traffic is initiated from the server in Azure to external .

The servers so not provide external services so the static nat is not sutable .

Can i do sub interfaces of the external interface of the firewall & Assign the additional public ips's?

Any help here is appreciated

Rule 

source                    destination         services 

server 1                  any                      any 

server 2                  any                      any 

server 3                 any                      any 

Nat Rule 

original source                translated source (hide)

server 1                            public 1

server 2                            public 2

server 3                            public 3 

[TOM_MORAN]

R80.20 is the version

[PhoneBoy]

If you don't want the servers to be publicly accessible but need outbound access for them, you can configure the NAT (and access policy) in one direction…or use hide NAT.

[TOM_MORAN]

Hi thanks for the reply,

it still does answer my question, how do i apply 3 separate hide nat's using three different public ip addresses.

I cannot use public addresses in policy as external & internal interfaces are private.

I need to know if this is possible please.

Best Regards,

Tom

[PhoneBoy]

From our perspective, this is possible--it would work just as you describe.
However, in this case, the final NAT to public IPs is done via Azure, not by the Check Point gateway.
If I understand how Azure works, you have to assign the VM a private IP for each Public IP you want.
Your HIDE NAT rules would, therefore, be in terms of these private IPs.

[Matthias_Haas]

for a single Gateway, this should work:

https://community.checkpoint.com/t5/CloudGuard-IaaS/STATIC-NAT-in-Azure-Checkpoint/m-p/75802#M1635 

[TOM_MORAN]

Hi I will test this asap & get back to you

very appreciated

Tom

[bmomartins]

Are you using a cluster? Does that work in that scenario?

[TOM_MORAN · Accepted solution]

 apologies on the long delay, this solution worked perfectly.

This was on a single gateway 

Many thanks