Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
RHigui
Explorer

NAT not direcltly connected network

Hi,

I have to give accès for an extenral partner to an internal server wich is in a network not direcktly connected to the Checkpoint R80.40 FW, below a basic schema that shows the network

schema.png

Static routes are configured in both Firewall and the L3 router, I can ping the internal server from the FW but can't connect to it from external

This is my Nat rule,

nat rule.png

I can see the packets arrived and accepted by firewall but no connection to that server,

Could you please see and help ?

thank you !

 

0 Kudos
3 Replies
Timothy_Hall
Champion
Champion

If the SAEIV_NAT_Address is "plucked" from the transit segment between the firewall and your Internet perimeter router, you will need to define a static proxy ARP for the SAEIV_NAT_Address because it is a manual NAT.  See sk30197: Configuring Proxy ARP for Manual NAT

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos
RHigui
Explorer

Thank you Tim,

I tried the proxy ARP and deosn't work, I tried to put the server on directly on the transit network (172.17.0.0) with an without proxy ARP and static NAT but not work.

Could you please give more info to fix this ?

 

Tnahks

0 Kudos
Timothy_Hall
Champion
Champion

You will need to do a tcpdump or cppcap on the firewall's internal interface to determine what is happening, my guess is the Nat_Node address does not have a proper proxy ARP and the inbound traffic is reaching the internal server but the reply is not coming back to the firewall.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events