NAT HIDE FAILURE

[DominusRex23]

Hide NAT Failure – Need Advice

Client is getting Hide NAT failure errors in ElasticXL setup. CPview shows only 1,785 available ports for hide NAT, which is way too low. Normally, we expect around 50,000 ports per hide IP to avoid session drops.

Has anyone encountered this issue in ElasticXL?

[emmap · Accepted solution]

This is a known issue, see: 

https://support.checkpoint.com/results/sk/sk183481

The patch is slated to be in the next JHF release (it's in the list of upcoming fixes in the JHF page) but TAC can supply it immediately if you raise a case and cite that SK.

[Chris_Atkinson]

Emma has provided the correct solution.

In case your interested in further background sk159572 provides a bit of a history lesson / alternate workarounds regarding NAT config.

[the_rock]

Since it is a known issue, maybe check if below is set to 1, if not, just set it and see if any luck.

Andy

fw ctl get int fwx_gnat_enabled