cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

Order of operations

Jump to solution

Hi everybody,

I have a question regarding order of operations during firewall inspection. As I saw in few posts, when packet arrives at interface, it's first matched against access policy, then destination NAT is considered, then routing, source NAT, and off it goes.

packet_flow.PNG

Anyway, if we have rule like this:

cp_static_nat.PNG

Web Server is a network object with private IP address and static NAT with public IP address checked under objects NAT properties. So automatic NAT rule is created, and bidirectional NAT is also checked under firewall global properties.

My question is - how then this works? And it does. If firewall policy is checked first then when a packet arrives at outside interface, there is no rule which allows from outside to web server's public address, only this one, and in logs, this rule matches.

I would appreciate if someone could clarify this.

Thanks in advanced.

0 Kudos
1 Solution

Accepted Solutions

Re: Order of operations

Jump to solution

Since you used the automatic NAT setup technique on the object "Web Server", when that object is placed into a rule it can match both IP addresses (the "real" address and the NAT address) since they both exist within the configuration of that object. 

This would most definitely not apply if the manual NAT setup technique was used, as two host objects would need to be created.  One object represents the "real" address and the other object represents the NAT address.  Because the network policy layer ("firewall policy") is referenced prior to the NAT policy, the latter host object representing this NAT address should be used in your firewall policy rule.

 

Book "Max Power 2020: Check Point Firewall Performance Optimization" Third Edition
Now Available at www.maxpowerfirewalls.com

View solution in original post

2 Replies

Re: Order of operations

Jump to solution

Since you used the automatic NAT setup technique on the object "Web Server", when that object is placed into a rule it can match both IP addresses (the "real" address and the NAT address) since they both exist within the configuration of that object. 

This would most definitely not apply if the manual NAT setup technique was used, as two host objects would need to be created.  One object represents the "real" address and the other object represents the NAT address.  Because the network policy layer ("firewall policy") is referenced prior to the NAT policy, the latter host object representing this NAT address should be used in your firewall policy rule.

 

Book "Max Power 2020: Check Point Firewall Performance Optimization" Third Edition
Now Available at www.maxpowerfirewalls.com

View solution in original post

Re: Order of operations

Jump to solution

Thank you very much Timothy. Would you be so kind to take a look at another topic I opened a week ago? Your answer would be most appreciated. Here is the link:

https://community.checkpoint.com/t5/Access-Control-Products/Site-to-Site-VPN-configuration-suggestio...

0 Kudos