Unable to create destination NAT rule for ICMP service

[Firewall_Head]

Dear Checkmates,

I'm having problem creating DST NAT rule for an ICMP traffic, I'm forced to create a rule with services as "ANY" for this to work. 

Can someone let me know if this is a limitation and so please share the relevant document from Check Point.

Thanks in advance!

=======

WR,

FH

[Lesley]

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuid...

NAT (Network Address Translation) is a feature of the Firewall Software Blade

 and replaces IPv4 and IPv6 addresses to add more security. NAT protects the identity of a network and does not show internal IP addresses to the Internet.

The Security Gateway can change:

• The source IP address in a packet.

• The destination IP address in a packet.

• The TCP / UDP port in a packet. (ICMP is not TCP or UDP)

[G_W_Albrecht]

https://community.checkpoint.com/t5/Management/Destination-NAT-with-ICMP/m-p/19275#M16164

sk66506: ICMP Error packets are not translated according to NAT rulebase

sk172933: NAT FAQ

[PhoneBoy · Accepted solution]

The NAT rulebase only permits usage of TCP and UDP services. 
I don't believe this is explicitly documented as SmartConsole provides an appropriate error when you attempt this configuration.
This is also a long-standing limitation going back to the earliest days of the product.

Having said that, the NAT rulebase only applies if the traffic is permitted by the Access Policy.

[Lesley]

You get a validation error when you try to sneak ICMP in a group in the rule. If you try to select icmp itself you cannot find it to select in the drop down menu