- Products
- Learn
- Local User Groups
- Partners
-
More
Celebrate the New Year
With CheckMates!
Value of Security
Vendor Self-Awareness
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
Mobile Security
Buyer's Guide Out Now
Important! R80 and R80.10
End Of Support around the corner (May 2021)
Hello all, I have what I believe is a unique question/situation. We are looking to split outbound traffic at one of our sites, but we would like to do it based on application control. Basically, all "normal" traffic would be NAT'ed to the regular hide NAT, but any traffic hitting an app control rule(skype/O365) would be NAT'ed to a different IP address. Is this scenario possible?
My best guess so far is creating two objects for the same internal network, but one would have a NAT specified in the object, and we would use that in the app control rule. I'm not entirely certain this would work, as the firewall would have no real way of discerning which group to reference when the internal traffic hits the ruleset.
1) Only simple services (i.e. port numbers) can be specified in a NAT rule. Using an object with an automatic NAT configured in the APCL policy will not affect how NAT is performed.
2) How a connection will be NATted is determined by the NAT policy upon receipt of the first packet of a connection after it has been accepted by the Firewall/Network Policy, well before APCL is invoked. This NAT cannot change for the life of the connection.
3) The application cannot be detected for TCP-based connections until the three-way handshake is complete and some data has started to flow in packets 4+. It is already far too late at that point to change the NAT address.
Unless you could somehow force the application in question to always use a certain unique port (like TCP 61321 or something) then leverage that unique port in a manual NAT rule to do what you want, I don't see how it would be possible.
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY