Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
handiansudianto
Advisor

NAT

Hello,

My 5800 checkpoint LAN IP is 10.103.253.10 and LAN subnet is 10.100.0.0/16,  then i have 2 vpn site to site to azure and the tunnel already established.

Now i have requirement to change that the traffic from LAN subnet if want go to 1st VPN tunnel (Subnet 10.200.0.0/16) will go directly without any NAT.

Then i also need traffic from LAN subnet if want go to 2nd VPN Tunnel (Subnet 10.150.0.0/16) should be NATted using interface ip address (10.103.255.10).

Anyone here know how to make that NAT? 

0 Kudos
12 Replies
the_rock
Legend
Legend

You can simply make manual nat rules in smart console based on those requirements. 

Andy

0 Kudos
handiansudianto
Advisor

Hello,

So my NAT setting is :

Original source : 10.100.0.0/16

Original destination : 10.150.0.0/16

And what should i choose on translate source so the traffic will be translated to my checkpoint interface?

the_rock
Legend
Legend

Whatever the IP is that needs to be translated to.

Andy

0 Kudos
handiansudianto
Advisor

Hi..

Already try with configuration below but have error 

 

Original source : 10.100.0.0/16

Original destination : 10.150.0.0/16

Translated Source : 10.103.107.1 

 

 

0 Kudos
the_rock
Legend
Legend

Let me test it in the lab and will let you know.

Andy

0 Kudos
the_rock
Legend
Legend

Works for me.

Andy

 

Screenshot_1.png

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Did you set it as hide or static?

CCSM R77/R80/ELITE
the_rock
Legend
Legend

Im fairly sure that can ONLY work with hide nat.

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Indeed I'm suggesting this is the likely cause for the error reported.

CCSM R77/R80/ELITE
the_rock
Legend
Legend

Yup, agree!

0 Kudos
handiansudianto
Advisor

Hello,

I change the static nat to hide and the error was gone, but actually when i try RDP from 10.100.50.25 to Azure windows VM  10.50.10.10 then i check in the task manager, the source is still from host 10.100.50.25 and not from 10.103.107.1.

What i can see on the log there only decrypt message and in the message detail there are no NAT rule.

0 Kudos
the_rock
Legend
Legend

In such a case that you described, ONLY hide nat rule would work, as you cant do static nat from subnet to subnet translation, for the lack of the better term.

If IP is different, just change the natted IP in the translated packet, push policy and test.

Andy

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events