[Brittin_C]

Happy ending...

So the solution is two fold...

First, on both clusternodes you must change the web files for login to include an ACTION in the FORM tag. This action should look like the following:

ACTION="http://<<IP or hostname of firewall node>>:900/"

This must be done on all nodes and the IP must be unique for each node. The "Real IP" of that node on the side facing the authenticator is the proper IP to insert. If your are using HTTPS for authentification then make the change accordingly to the line above.

Second, if you require the use of HTTPS to the target of your Static NAT, you must change a global property. Under global properties select SmartDashboard Customization... there should be button labeled "Configure". Click configure and navigate to: Firewall-1 --> Web Security --> HTTP Protocol. Check the box titled "http_use_host_h_as_dst". Push your policy.

If you dont check this box then Checkpoint will get all confused thinking the HTTPS is directed at it and not the NAT target and drop the packet. Why it thinks this, god only knows. If you dont need HTTPS, you can skip this step.

There ya'all go, hope it helps someone.