HTTPS incoming inspection with static NAT

[Yevgeniy_Yeryom]

Hello experts, 

Do you know if there are some limitation in terms of using #HTTPS incoming inspection with static NAT#?

Does some special configuration required when configuring  HTTPS incoming inspection with static NAT?

In my LAB as you can see in the logs below:

- incoming inspection without NAT to 10.1.11.3 is inspected,

- incoming inspection with NAT to 10.1.2.10 is NOT inspected.

I tried it with static and automatic NAT and became the same result.

By the way:

There is an SK on that about automatic NAT problem stating that a HF might be required.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

Is a hot fix required?

[PhoneBoy]

Did you make the policy changes mentioned in the SK?

If you do that he hotfix should not be required.

[Yevgeniy_Yeryom]

Hi,

yes I did. 
As shown in the screenshot, the source IP and destination IP (NAT IP representing the server) are in the same subnet. 

I changed the destination IP to an IP from a different subnet and the HTTPS inspection started to work.  

To put together, the incoming HTTPS inspection seems to NOT work for the source and destination from the same subnet. I think this is fine for usual use cases. 

[PhoneBoy]

I'm not familiar with a limitation relating to HTTPS Inspection being not possible in the same subnet.

Clearly, it's possible.

It may be worth a TAC case, particularly if it's a customer situation.

[Yevgeniy_Yeryom]

Actually it was a test for customer, but customer will use NOT have the clients and firewall in the same subnet. 

So, this behavior is ok for the project.