Creating NAT rules with dbedit

[ekagan2]

Can someone please provide an example of creating a static NAT policy rule with DBEdit?

I am looking to create many rules like these ones with a script

orig src      orig dest        orig svc  NATed src       NATed dest    NATed svc  Install on
------------- ---------------  --------  --------------  ------------  ---------  -----------
SOME-NET      host-natted-ip   any       original        host-real-ip  original   firewall123
host-real-ip  SOME-NET         any       host-natted-ip  original      original   firewall123

Thanks,

Eli

[_Val_]

Why dbedit? It is legacy and bad for scripting. Uye MGMT API instead

https://sc1.checkpoint.com/documents/latest/APIs/#cli/add-nat-rule~v1.6%20

[ekagan2]

I am running r77.30. I think dbedit is my only option, isn't it?

[_Val_]

Unfortunately, yes. Just a reminder, R77.30 is out of support from September 2019. 

[_Val_]

Also, I thinnk dbedit does not have an option to add NAT rules. You still can enable automatic NAT on an object with it, though:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
https://sc1.checkpoint.com/documents/R77/CP_R77_Multi-DomainSecurityManagement_WebAdminGuide/105997....

[PhoneBoy]

There is likely a way to do it via dbedit but it's not documented anywhere.

[Maarten_Sjouw]

The automatic way does not work as he has a specific network he wants to add as the source or destination.

[_Val_]

True. I think the best would be to lift management to one of R80.x, so API would be available. I do not see a way to add manual NAT rules with dbedit (Despite what @PhoneBoy is implying :-))

[PhoneBoy]

You obviously underestimate my ability to figure out dbedit 🙂

[_Val_]

Prove it please 🙂

[PhoneBoy · Accepted solution]

You realize that's a challenge I can't back down from, right? 😬
In the following example, I have an existing manual rule in the NAT rulebase in the policy package MyPolicy.
I am adding a manual NAT rule to this to do source NAT for MyObject to MyObject-Public. 

addelement fw_policies ##MyPolicy rule_adtr address_translation_rule
modify fw_policies ##MyPolicy rule_adtr:1:comments "This is really Rule number 2"

addelement fw_policies ##MyPolicy rule_adtr:1:src_adtr network_objects:MyObject
addelement fw_policies ##MyPolicy rule_adtr:1:dst_adtr globals:Any
addelement fw_policies ##MyPolicy rule_adtr:1:services_adtr globals:Any

modify fw_policies ##MyPolicy rule_adtr:1:src_adtr_translated translate_static
modify fw_policies ##MyPolicy rule_adtr:1:src_adtr_translated:'' network_objects:MyObject-public
modify fw_policies ##MyPolicy rule_adtr:1:dst_adtr_translated translate_static
modify fw_policies ##MyPolicy rule_adtr:1:dst_adtr_translated:'' globals:Any
modify fw_policies ##MyPolicy rule_adtr:1:services_adtr_translated service_translate
modify fw_policies ##MyPolicy rule_adtr:1:services_adtr_translated:'' globals:Any

update_all

(Note: It is helpful to refer to $FWDIR/conf/classes.C when you're figuring out how to do things in dbedit).

Note modifying the NAT rulebase with dbedit has the same basic limitations as the regular rulebase.
Namely, it's easy to add rules to the bottom of the rulebase, but not necessarily "somewhere in the middle" as it involves deleting all the rules below and re-adding them.

In short, it's really worth upgrading your management to R80.x as this is much easier, has better documentation, and more importantly, is supported.

[_Val_]

@PhoneBoy strikes again, well done!

[ekagan2]

Thank you so much. That worked.

A quick question, is there a way to know which rule number the new rule will be added as or do I need to count them manually?

[PhoneBoy]

Short of listing the rulebase itself beforehand, no.
Like I said, you are way better off upgrading your management so you can leverage the REST API which is easier to work with, has better documentation, and is supported.