NAT issues from the gateway itself

[philofish]

Dear All

I think i have narrowed down the solution to why i am having problems with a simplified VPN install - Apprently the remote gateway is looking up the internal IP address of the smart centre server which sits behind the local gateway and cannot obtain the CRL - thats why i am getting an invalid certificate error message in the logs - apparently

The checkpoint solution is to NAT the the smart centre servers destination private address to the smart centre servers public address on the remote gateways NAT rules

What i mean is [test lab]
remote gateway - external ip = 192.168.40.1

Local gateway - public ip = 192.168.30.1
Local gateway - internal ip = 192.168.5.1
smart centre server = 192.168.5.40

Problem
The problem is that remote gateway cannot obtain the CRL (certification revocation list) from the local smart centre server located behind the local gateway

Solution

I apparently have to NAT from the remote gateway using the following method -

Taken from checkpoint site
For the remote gateway, the following network address translation rule should be placed at the top of the network address translation rules:

ORIGINAL PACKET
SOURCE: Remote gateway
DESTINATION: <internal private IP address of management module>
SERVICE: fw1_ica_services
TRANSLATED PACKET
SOURCE: = Original
DESTINATION: <statically NATed IP address of management module>
SERVICE: = Original


The thing is it doesn't work - how do i get the remote gateway to perform destination NAT?
When i fire up a connection the destination address is still that of the private IP address of the management server and not the NATTED public address - thus the connection drops at the router in the middle
I can do this with hosts behind the remote gateway - as i think NAT is performed on the ingress NIC - but with the gateway the NAT is on the egress NIC as it can send remote traffic only one way!

Has anyone done this before - its baffling me!

Many Thanks

PS - there is no XLATE DST in the logs !

[kva.kva]

Try to use automatic static nat (in properties SC object) with option "Apply for VPN-1 Pro/Express control connections".