fw up_execute Equivalent for NAT Rule Matches?

[Timothy_Hall]

fw up_execute can be run on the gateway to find a matching Network policy rule in the live policy like this:

Is there an equivalent CLI utility to find a matching NAT policy rule on the live gateway?  I'm aware that Packet Mode searches can be executed against the NAT policy in the SmartConsole, but I'm looking for a CLI utility on the gateway itself.  Thanks!

[PhoneBoy · Accepted solution]

Haven’t seen and with NAT it’s a bit more complicated due to the fact some of the NAT isn’t handled by actual rules but rather as a result of object definition.

[Timothy_Hall]

Not even in R81?  It seems like the NAT policy in that version is now acting more like a "real" policy layer, and allowing the use of Security Zones & Dynamic Objects including Access Roles, as well as keeping hit counts.

[PhoneBoy]

Perhaps there's a hidden flag for fw up_execute?

[Richard_Carson]

bump thread - this would be a useful feature

[Timothy_Hall]

You can try searching the contents of the fwx_cache table which will hold the most recently hit NAT rules, see my post here:

https://community.checkpoint.com/t5/General-Topics/NAT-Cache-Table-Full/m-p/53547/highlight/true#M10...

here is another helpful tool as well:

showtable.sh - it shows statistics of the connecti...