Whilst deploying pair of Checkpoint 1590 Appliances running R80.20 I noticed some strange behaviour which I have been unable to resolve
I am succesfully able to NAt source IPs for remote VPN sources for inbound traffic passing through to internal networks, as well as internal objects destined for remote IPSEC VPN networks but am struggling to NAT a network object defined in the DMZ leg heading inbound to internal networks. Something which I was able to do with R71 without any issue.
DMZ 192.168.230.x LAN7 172.17.x.x
----------------------- CHECKPOINT 1590 --------------------JUNIPER---- Router----172.22.x.x
So basically I'd like to NAT an object with has an IP of 192.168.230.20 to SNAT 192.168.230.10 when communicating hosts in 172.22
SO I have a manual NAT rule which does exactly that for 172.22.x.x destination . However, what ever I do , the traffic is not NATed if I tcpdump the LAN7 interface. I still see the traffic leave as 192.168.230.20 and not 192.168.230.10.
Additionally if I try to either hide behind the internet interface for outbound traffic with the option to SNAT behind internet Gateway or set a manual NAT for internet access, again this object's source IP is not NAT'ed. SO I was wondering are there any implicit rules or functions that treat traffic on the inbuilt predefined DMZ interface differently perhaps?
I have successfully managed to configure traffic from the internal 172.22.x.x to SNAT behind an IP on the LAN7 range en route to a remote host VPN ...
Is there something simple here that I am missing, are objects in the DMZ managed differently?
For completeness, I will try moving the 192.168.230.0/24 network to a normal LAN port when in the office again tomorrow
Thanks again for your assistance