NAT Rules not matching with new R82 gateway in place.

[khodgson_bts]

Morning.

We're trying to cut over from a cluster of 5000 series running R81.10 to a new cluster of 9000 series running R82 JHFA take 44. Management is running R82 take 44 as well and has been for several weeks now.

Within the NAT policy there are several NAT rules with "Gateways" in the install on column (screenshot attached). What seems to be happening is that when we flip over to the R82 gateway these NAT rules are not being matched and all Internal to Internal traffic is hitting the final manual NAT rule to hid behind the gateway public IP. It doesn't seem to be an issue when running on the old R81.10 gateway.

Where does this "Gateways" target come from and is it no longer supported on R82?

Thanks

[Chris_Atkinson]

Have you tried editing the "Gateways" object, what does it yield?

Unfortunately I cannot make out the object icon from the screenshot on my phone right now.

[khodgson_bts]

It's not editable at all. Double click or right-click edit is unavailable.

[Alex-]

I've seen this on environments which were upgraded from R7X all the way to R81.XX. Seems like a dynamic objects representing the gateways, which doesn't exist anymore. So it's in the configuration but can not be edited, added and so on.

As the release notes state that R82 doesn't support R77.30 versions, it might not be enforced at all.

[khodgson_bts]

I suspected this might be the case. As far as I can tell from the history, this policy has been around since somewhere around the R65 days so what you're saying makes sense. We've got a change scheduled for later to change all those to "Policy Targets" and try again.

Thanks!

[the_rock]

For sure...if its been around since R65 days, then all @Alex- said is 100% logical.

[khodgson_bts · Accepted solution]

So, it's confirmed that the "Gateways" installation target is not supported/enforced on R82 gateways. We change all the rules to use "Policy Targets" and this solved the issue.