Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Adam_Forester
Ambassador
Ambassador

Updateable Objects and NAT

One of the best new features in R80.20 is updateable objects. You can read more here

I had a customer that asked specifically about using them in NAT rules as they wanted a separate HIDE-NAT for outbound access to public Azure vs their private Azure VN. We discovered that the updateable objects could not be used in NAT rules. 

After some digging, we determined that updateable objects when used created a dynamic object on the gateway. You can display them using 'dynamic_objects -uo_show' on the gateway. As you can see below the object has a dynamic object link but not a dynamic object created in smartdashboard, the updateable seems to be a link to this object. 

dynamic_object -uo_showdynamic_object -uo_show

 

Screen Shot 2019-04-24 at 10.11.50 AM.png

 

If you use the name from 'dynamic_objects -uo_show'  you can create a dynamic object using the same name. This will create a physically link to the dynamic object that was created by the updateable object. You can then use that dynamic object in a NAT rule.

Screen Shot 2019-04-24 at 11.45.58 AM.png

 

You can see the log below;

Screen Shot 2019-04-24 at 11.45.26 AM.png

 

 

26 Replies
HeikoAnkenbrand
Champion
Champion

Special hack:-)

Add a small bash script on the management server to do the following:

1) Add and remove an object (for example a host or network)  and a NAT rule via management CLI on the management server. This new object is not a dynamic object but can used for NAT.

2) Add a new rule with a dynamic object via management CLI.

3) Use my script from the following Checkmates article to execute remote commands on the gateway from the management server and add the IP adresses to the dynamic objekts on the gateway.

Link to Checkmates article:

GAIA - Easy execute CLI commands from management on gateways

 

 

HeikoAnkenbrand
Champion
Champion

If necessary you do not need points 2 and 3 from my last instructions.

0 Kudos
Michal_Gans
Contributor

After upgrade to R80.40 this "hack" stop working. I will open TAC ticket, but I want to inform others to save them lot of frustration during upgrade. 🙂

0 Kudos
Dwhight
Explorer

I thought this was fully supported as feature in R80.40? Do they still not allow the functionality to do this in the new release? 

0 Kudos
PhoneBoy
Admin
Admin

Which is interesting as this SK suggests it's an issue in R80.30 (not R80.40): https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
I'll have to check with R&D on this one.

Pretty sure we will have formal support of Updatable Objects in the NAT policy in R81.
0 Kudos
Timothy_Hall
Champion
Champion

How about use of Security Zone objects in the R81 NAT policy?  Please say yes as that would make replicating NAT rules from other vendors' zone-based or "NAT interface pair" type firewalls SO much easier.

New 2021 IPS/AV/ABOT Self-Guided Video Series
now available at http://www.maxpowerfirewalls.com

I second Tim this will be really cool feature to have.

0 Kudos
Michal_Gans
Contributor

I have reply from TAC "NAT with updatable object is not supported on R80.40."
0 Kudos
PhoneBoy
Admin
Admin

While this capability has been available (if you know how) since R80.20, officially it is not supported in current releases.
R81 is supposed to offer formal support without having to create a Dynamic Object for it 🙂

Apparently, this discovered workaround doesn't work for all Updatable Objects.
As it was never formally supported anyway, it was decided to block the configuration entirely.

For those who had enabled it and it worked, what Dynamic Objects did you use?
0 Kudos
Michal_Gans
Contributor

I used Updateable Object "Exchange Services" so it was Dynamic Object "CP_MS_Exchange" and it worked on R80.30.

0 Kudos
Aaron_Vivadelli
Contributor

Nice find!  This would be very helpful in another context if you could use Dynamic Objects (or Updateable Objects) in the HTTPS Inspection policy.

PhoneBoy
Admin
Admin

Amazing find!

0 Kudos
Jonathan_Griffi
Participant

This is a great find. I find myself in a similar situation regarding Azure Express Route. Does anyone know if this is officially supported by Checkpoint?

Thanks,

Jon

0 Kudos
PhoneBoy
Admin
Admin

Will admit, I don't know the official stance on this.
However, NAT with Dynamic Objects is considered generally supported.
0 Kudos
Jonathan_Griffi
Participant

Thanks for the prompt response, are there any dynamic objects predefined for Azure Regions etc in R80.20 / .30? 

Thanks,

Jon

0 Kudos
Adam_Forester
Ambassador
Ambassador

there are updateable objects. The dynamic objects you would have to manually define. 

0 Kudos
Timothy_Hall
Champion
Champion

Just one performance-related note to add: when a Dynamic Object is referenced in a NAT rule and the Dynamic Object is updated, this will cause an immediate flush of the entire NAT Cache (table fwx_cache) which is used to cache successful lookups in the NAT policy.  Installing policy to the gateway also causes an immediate flush of fwx_cache regardless of whether Dynamic Objects are used. 

This really shouldn't be a big deal performance-wise, but if for some reason the Dynamic Object is taking updates constantly, it may cause slightly higher Firewall Worker instance CPU utilization for policies with a large number of NAT rules, due to lots of extra NAT rulebase lookups occurring.  SecureXL NAT Templates (a separate mechanism for caching NAT operations for connections matched by Accept Templates) are not flushed when a Dynamic Object is updated due to the use of NMR templates.

 

New 2021 IPS/AV/ABOT Self-Guided Video Series
now available at http://www.maxpowerfirewalls.com
Benedikt_Weissl
Advisor

Very Nice! Please add a offical sk for this
0 Kudos
Kaspars_Zibarts
Authority
Authority

Initially I screamed of joy as we are facing exactly the same issue and after adding dynamic object (DO) it all looked good until i noticed that some O365 traffic began to miss updatable object (UO) rule and instead used "overflow" rule that's based on our own script to capture O365 IPs. Up until I created and pushed that dynamic object we had zero hits on overflow rule! So it looks like you should thread this very carefully - I have a feeling that pre-defined name of UO and manually created DO name somehow are clashing. After removing DO object completely and pushing policy, we got back to normal situation

 

image.png

Adam_Forester
Ambassador
Ambassador

you are 100% correct. I thought I had updated this document but it was in my How-To-Video here on the site. I will update it today. If you do this you have to add the DO to the rule it will use it not the UO but you have to use the UO because otherwise it wouldn't update. It's not a perfect system it's kind of a hack. But this is fully supported in R80.40 as seen at CPX!

Kaspars_Zibarts
Authority
Authority

Yap just confirmed with someone from "inside" that it will be supported in next release 🙂 assuming R80.50. Good enough for us!
0 Kudos
PhoneBoy
Admin
Admin

If you want to use a the DO somewhere, you definitely need to use the UO somewhere in the same policy or...it won't update.
0 Kudos
David_Babrick
Explorer

@Kaspars_Zibarsts, are you using a dynamic object for the O365 services/ports? If so how do you achieve that?
0 Kudos
Dwhight
Explorer

This is a really cool way for me to be able to use NAT rules for inbound traffic from O365 when doing things like exchange hybrid configurations to lock down access to specific directories through F5 VIP's, and I've implemented this in an environment but after pushing the policy install i've started to receive error logs around DNS - mostly in relation to what's outlined here. Although i'm running R80.30 JHF 155 and this isn't occuring when creating Domain objects, instead Dynamic Objects. 

During the first policy install the environmental changes were to create a security rule referencing the updateable objects (Azure/O365), to populate the dynamic object database on the gateway, then the errors started occurring when installing the NAT rule changes to reference them (screenshot example below) 

NAT issues.png

 

I've created a TAC case regarding this, as it's certainly odd behavior but i'm just curious if anyone else has ran into a similar issue? 

0 Kudos
Teddy_Brewski
Contributor

Hello,

Is this approach still working with R80.40? I tried to add dynamic object and it complained about reserved words.

I'm under R80.40 take 91.

Thanks.

0 Kudos
PhoneBoy
Admin
Admin

I believe using Dynamic Objects in this way was blocked at some point.
However, you can use Updatable Objects in the NAT rulebase directly in R81.

0 Kudos