Source (hide behind) NAT non gateway IP and multiple ISPs

[cjames88]

I'm fairly new to Checkpoint and I've hit a scenario that I'm having trouble finding documentation on. I have a cluster with 3 ISPs. We do not have BGP so each of these 3 ISPs have a different subnet of public IPs. On our previous Juniper SRX firewalls we would source NAT our Guest WiFi out an address other than the primary IP on the interface. So far I can't find a way to handle this with multiple ISPs on checkpoint. I can see where I can tell a subnet to source NAT behind a specific IP, however I have 3 different IP address this traffic could source nat behind depending on which ISP we are using at the time. We also currently use PBR to route this traffic out one of what would be our backup ISPs.

[PhoneBoy]

I see a couple of options here:

• Use ISP Redundancy and the related configuration (possibly related: https://support.checkpoint.com/results/sk/sk174197) 
• Use a HIDE address of 0.0.0.0 (create as a host object), which I believe will use the IP address of the interface the traffic is routed out of. Not sure if this is formally supported, though.

[cjames88]

That's actually what we are trying to avoid, we don't want to use the IP address of the interface. I've got that working fine. It's when we want to use a different IP that things are breaking.

[PhoneBoy]

Then your only option is a Dynamic Object that you manage OR a static host object.

[Chris_Atkinson]

Have you tried NAT statements with each interface assigned/representing a different "zone" ?

[cjames88]

That I had not and I was hoping to avoid placing each ISP into it's zone since it's has it's own set of pitfalls that we've had to deal with on Juniper for years.

[PhoneBoy]

Am curious what issues you ran into with this, just for my own edification.

[cjames88]

Not so much issues, but it was a lot of extra administrative overhead with additional firewall and NAT rules.

[cjames88]

I will say the biggest pitfall we ran into was with VPN since they each had their own security zone due to other Junos limitations. Even though we ran iBGP on the tunnels, if we failed over any sessions would get interrupted since that traffic was now technically to and from different zones.

[PhoneBoy]

I don't believe we will have this limitation since Zones were not even supported until R8x and the VPN code has been there from the earliest days of the product.