NAT Rules not matching with new R82 gateway in place.

[khodgson_bts]

Morning.

We're trying to cut over from a cluster of 5000 series running R81.10 to a new cluster of 9000 series running R82 JHFA take 44. Management is running R82 take 44 as well and has been for several weeks now.

Within the NAT policy there are several NAT rules with "Gateways" in the install on column (screenshot attached). What seems to be happening is that when we flip over to the R82 gateway these NAT rules are not being matched and all Internal to Internal traffic is hitting the final manual NAT rule to hid behind the gateway public IP. It doesn't seem to be an issue when running on the old R81.10 gateway.

Where does this "Gateways" target come from and is it no longer supported on R82?

Thanks

[Chris_Atkinson]

Have you tried editing the "Gateways" object, what does it yield?

Unfortunately I cannot make out the object icon from the screenshot on my phone right now.

[khodgson_bts]

It's not editable at all. Double click or right-click edit is unavailable.

[Alex-]

I've seen this on environments which were upgraded from R7X all the way to R81.XX. Seems like a dynamic objects representing the gateways, which doesn't exist anymore. So it's in the configuration but can not be edited, added and so on.

As the release notes state that R82 doesn't support R77.30 versions, it might not be enforced at all.

[khodgson_bts]

I suspected this might be the case. As far as I can tell from the history, this policy has been around since somewhere around the R65 days so what you're saying makes sense. We've got a change scheduled for later to change all those to "Policy Targets" and try again.

Thanks!

[the_rock]

For sure...if its been around since R65 days, then all @Alex- said is 100% logical.

[khodgson_bts · Accepted solution]

So, it's confirmed that the "Gateways" installation target is not supported/enforced on R82 gateways. We change all the rules to use "Policy Targets" and this solved the issue.

[CheckPointerXL]

any official reference?

[the_rock]

Really odd...I use gateways as install target in R82 lab, never any issues. Maybe someone else can confirm.

[khodgson_bts]

We didn't even have Gateways as an available option on new rules. Very odd.

[the_rock]

I will check in the lab shortly, but Im 100% positive I had seen it there before and changed it few times.

[the_rock]

Do you see below option?

 

[khodgson_bts]

Yes I have that, but those are explicitly defined Gateway objects. The one I'm referring to is kind of a dynamic object which I believe references any object defined as a gateway. It looks like this:

[the_rock]

Ah, got it...my apologies then. That, sadly, cant find...what I pasted was all that came up. Let me keep checking.

[Alex-]

Not much to check, this object can't be used anymore. It might be imported from long-standing configurations which were upgraded from version to version up to now, but that's about it. And as discussed, since R82, it stops being enforced altogether.

An honestly, "Policy targets" is way more explicit and understandable than just "Gateways".

[the_rock]

You are 100% right Alex. I will triple check everything, but Im 99.99% sure it wont be there.

[khodgson_bts]

That's exactly the conclusion we came to. It just doesn't seem to be documented or reference anywhere that I can find.

In the meantime, we've added this to our list of things to watch out for when planning upgrades to R82+

[the_rock]

I looked everywhere, no dice, so its safe to say its not there, for sure.

[khodgson_bts]

None that I can find, no.