NAT

[handiansudianto]

Hello,

My 5800 checkpoint LAN IP is 10.103.253.10 and LAN subnet is 10.100.0.0/16,  then i have 2 vpn site to site to azure and the tunnel already established.

Now i have requirement to change that the traffic from LAN subnet if want go to 1st VPN tunnel (Subnet 10.200.0.0/16) will go directly without any NAT.

Then i also need traffic from LAN subnet if want go to 2nd VPN Tunnel (Subnet 10.150.0.0/16) should be NATted using interface ip address (10.103.255.10).

Anyone here know how to make that NAT? 

[the_rock]

You can simply make manual nat rules in smart console based on those requirements. 

Andy

[handiansudianto]

Hello,

So my NAT setting is :

Original source : 10.100.0.0/16

Original destination : 10.150.0.0/16

And what should i choose on translate source so the traffic will be translated to my checkpoint interface?

[the_rock]

Whatever the IP is that needs to be translated to.

Andy

[handiansudianto]

Hi..

Already try with configuration below but have error 

Original source : 10.100.0.0/16

Original destination : 10.150.0.0/16

Translated Source : 10.103.107.1 

[the_rock]

Let me test it in the lab and will let you know.

Andy

[the_rock]

Works for me.

Andy

 

[Chris_Atkinson]

Did you set it as hide or static?

[the_rock]

Im fairly sure that can ONLY work with hide nat.

[Chris_Atkinson]

Indeed I'm suggesting this is the likely cause for the error reported.

[the_rock]

Yup, agree!

[handiansudianto]

Hello,

I change the static nat to hide and the error was gone, but actually when i try RDP from 10.100.50.25 to Azure windows VM  10.50.10.10 then i check in the task manager, the source is still from host 10.100.50.25 and not from 10.103.107.1.

What i can see on the log there only decrypt message and in the message detail there are no NAT rule.

[the_rock]

In such a case that you described, ONLY hide nat rule would work, as you cant do static nat from subnet to subnet translation, for the lack of the better term.

If IP is different, just change the natted IP in the translated packet, push policy and test.

Andy