i I o O[FW Monitor] all via same interface

[Sangeeth_N]

Setup :                      External------------->[Checkpoint]-----------> DMZ

Configured a static NAT for a server hosted in DMZ . When trying to access the same from the external network, the traffic is reaching the External  interface and going out via External interface itself instead of DMZ interface.

This is observed when a packet capture is done i, I, o, O all are observed on the same External interface  [using fw monitor].

Any specific reason for this weird issue? anybody encountered the same issue?

Suggestions will be helpful.

Thanks in Advance...

[Timothy_Hall · Accepted solution]

In the SmartConsole NAT Global Properties is "translate destination on client side" unchecked for the type of NAT config (Automatic vs. Manual) you are using?  If so you will need a static host-based route added to the firewall's routing table like this:

External NAT Address/32 -> Real Server DMZ address

[Maarten_Sjouw]

Or you need to turn the option ON, which is by far the better way to solve it. There are very few reasons to not do that.
Keep in mind that in older -migrated many times- setups, this was the default. Also watch out that you could break things when you change this without double check on other inbound NAT's.

[Wolfgang]

If you don‘t see any NAT translated packet in the four states you followed Tim’s suggestions.

the packets comes in with an external address to an address address of the external interface. It is processed through all firewall states and after I is handled via the routing daemon. If no NAT occurs, it‘s routed back to the external address of the sending system.

You have To set the host route or enable translation on client site. 

[HeikoAnkenbrand]

Please copy the output of  the following command into the forum, then we can see what's going on.

# fw monitor -p all -e "accept(<your filter>);"