Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Ivan_Kusturic
Participant
Jump to solution

Order of operations

Hi everybody,

I have a question regarding order of operations during firewall inspection. As I saw in few posts, when packet arrives at interface, it's first matched against access policy, then destination NAT is considered, then routing, source NAT, and off it goes.

packet_flow.PNG

Anyway, if we have rule like this:

cp_static_nat.PNG

Web Server is a network object with private IP address and static NAT with public IP address checked under objects NAT properties. So automatic NAT rule is created, and bidirectional NAT is also checked under firewall global properties.

My question is - how then this works? And it does. If firewall policy is checked first then when a packet arrives at outside interface, there is no rule which allows from outside to web server's public address, only this one, and in logs, this rule matches.

I would appreciate if someone could clarify this.

Thanks in advanced.

0 Kudos
1 Solution

Accepted Solutions
Timothy_Hall
Legend Legend
Legend

Since you used the automatic NAT setup technique on the object "Web Server", when that object is placed into a rule it can match both IP addresses (the "real" address and the NAT address) since they both exist within the configuration of that object. 

This would most definitely not apply if the manual NAT setup technique was used, as two host objects would need to be created.  One object represents the "real" address and the other object represents the NAT address.  Because the network policy layer ("firewall policy") is referenced prior to the NAT policy, the latter host object representing this NAT address should be used in your firewall policy rule.

 

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com

View solution in original post

2 Replies
Timothy_Hall
Legend Legend
Legend

Since you used the automatic NAT setup technique on the object "Web Server", when that object is placed into a rule it can match both IP addresses (the "real" address and the NAT address) since they both exist within the configuration of that object. 

This would most definitely not apply if the manual NAT setup technique was used, as two host objects would need to be created.  One object represents the "real" address and the other object represents the NAT address.  Because the network policy layer ("firewall policy") is referenced prior to the NAT policy, the latter host object representing this NAT address should be used in your firewall policy rule.

 

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
Ivan_Kusturic
Participant

Thank you very much Timothy. Would you be so kind to take a look at another topic I opened a week ago? Your answer would be most appreciated. Here is the link:

https://community.checkpoint.com/t5/Access-Control-Products/Site-to-Site-VPN-configuration-suggestio...

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events