NAT not direcltly connected network

[RHigui]

Hi,

I have to give accès for an extenral partner to an internal server wich is in a network not direcktly connected to the Checkpoint R80.40 FW, below a basic schema that shows the network

Static routes are configured in both Firewall and the L3 router, I can ping the internal server from the FW but can't connect to it from external

This is my Nat rule,

I can see the packets arrived and accepted by firewall but no connection to that server,

Could you please see and help ?

thank you !

[Timothy_Hall]

If the SAEIV_NAT_Address is "plucked" from the transit segment between the firewall and your Internet perimeter router, you will need to define a static proxy ARP for the SAEIV_NAT_Address because it is a manual NAT.  See sk30197: Configuring Proxy ARP for Manual NAT

[RHigui]

Thank you Tim,

I tried the proxy ARP and deosn't work, I tried to put the server on directly on the transit network (172.17.0.0) with an without proxy ARP and static NAT but not work.

Could you please give more info to fix this ?

Tnahks

[Timothy_Hall]

You will need to do a tcpdump or cppcap on the firewall's internal interface to determine what is happening, my guess is the Nat_Node address does not have a proper proxy ARP and the inbound traffic is reaching the internal server but the reply is not coming back to the firewall.