- Products
- Learn
- Local User Groups
- Partners
- More
Stop Babysitting Rules.
Go Agentic
Step Into the Future of
AI-Powered Cyber Security
The State of Ransomware Q1 2026
Key Trends and Their Impact
AI Security Masters E8:
Claude Mythos: New Era in Cyber Security
Blueprint Architecture for Securing
The AI Factory & AI Data Center
Call For Papers
Your Expertise. Our Stage
CheckMates Go:
CheckMates Fest
Not sure this would work out of the box on R8x either.
The issue is, to achieve NAT Hide on a non-GW IP, you need to use a Dynamic object for the active ISP NAT-Hide address in the Nat rule, and that IP should be changed when failover happens. Even there, there might be an issue with a n automatic ARP after failover.
We have a SecureKnowledge article describing ranges for ISPr and scripts to switch those in case of failover. It is sk174197.
This might work for you, if you replace a range with a single non-GW IP address (effectively /32 range).
Concerning the management decision, having ability to open a support case should be enough reason for me. Do you even have a support contract in place?
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY