cancel
Showing results for 
Search instead for 
Did you mean: 
Post a Question

Management behind NAT

Jump to solution

Good day.
Help me to solve the following problem:
1. We have a dedicated management server (M) with a local IP address (10.1.0.100)
2. In the local network, there are several firewalls A and B (HW 5000) (10.1.1.200 and 10.2.1.200)
3. Outside the local network, we have branches in which the firewalls C, D, E (HW 1400), etc. are located. (1.1.1.1,2.2.2.2,3.3.3.3)

During the configuration of this topology, the problem of adding firewalls of branches (C, D, E) to the management server.

In order for the branch firewalls to see the management server from the outside(internet) and be able to interact with it, an automatic static rule was made (ext IP 5.5.5.5) and the function "Apply for SG control connections" is enabled

In this configuration, the branch firewalls work fine, but the local firewalls do not interact with the management server since they attempt to establish a connection with mng server (M) to an external address configured with a static nat.

How to be in this situation?

1 Solution

Accepted Solutions

Re: Management behind NAT

Jump to solution

Have you checked the sk100583 - Troubleshooting "SmartCenter behind NAT" issues?

If not, look at the Scenario 4.

2 Replies

Re: Management behind NAT

Jump to solution

Have you checked the sk100583 - Troubleshooting "SmartCenter behind NAT" issues?

If not, look at the Scenario 4.

Danny
Pearl

Re: Management behind NAT

Jump to solution

Hello Andrey,

this is a very common issue, you have done everything correctly.

In order to have your local firewalls to talk to your management server on its local IP address (10.1.0.100), simply replace the external IP with the local one of your management within the $FWDIR/conf/masters file of each affected gateway (sk40090) and prevent it from being overwritten on policy install (sk102712). That's it.