Thursday, 2 February 2017

investigating NAT issues on checkpoint firewalls

In Network Objects (bottom left)
Right click Nodes -> More -> Query Objects
Refine by: Search by IP

Double click on the object and check the NAT section for auto NAT

Also you can do Actions -> Where used -> Active policy
Look for any manual NAT's here

Try the traffic while watching the logs in the tracker
You can add the columns xlatesrc and NAT rule into the tracker
Also you can double click the log entry and get more details on the NAT rule and xlated source

Auto NAT's are processed first
Manual NAT's second


In some cases you may need to add and arp
SSH to CLI of CP firewall
clish 
show configuration
Looks for arp
add arp proxy ipv4-address x.x.x.x. interface eth1-02 real-ipv4-address y.y.y.1

x.x.x.x is the IP of your server
y.y.y.y is the IP of your gateway

No comments:

Post a Comment