NAT Pool Issue

[petronius]

Is there a way to have an address pool (say a subnet) that is used for outgoing NAT assignment? Much like PAT but using a pool of addresses instead of using ports and a single address.

So on a PIX I can define an outgoing nat pool to be a range of addresses. As users go out, they grab one of those addresses from the pool and off they go.

Trying to recreate this on CheckPoint and can't seem to find it.

[kva.kva]

As I know it's unsupported feature (if you use different ranges for real and public addresses). It will be working after manual editing user.def file, may be. But it's only for testing not for real using.

[joris]

Anyone knows if the NAT POOL issue that petronius have is supported in R65 ?

[accesslimiter]

If you define two network ranges with equal count you can use this with outgoing source NAT, static or hide.

[joris]

Originally Posted by accesslimiter

If you define two network ranges with equal count you can use this with outgoing source NAT, static or hide.

mhh, what we want to achieve

original
source = any
destination = IP range/subnet ....

translated
source = IP range/subnet ....
destination = original

there is no 1:1 relation between original source and translated source.

any hints ?

[mcnallym]

Use an Address Range and use that as the NAT for the Subnet that are translating. It will just use the next range in the IP range.

However looking at your requirement, is there any reason you cannot use a Hide NAT instead of an IP range to hide behind.

[cuthbei]

I have spent a few hours trying to configure this today by altering the user.def file, but with no luck. I want to use this as my customer wishes to offer premium users a fixed personal IP for the length of the session, rather than share it with other users. If anyone has got this working on R65 I would love to know how.

Thanks, Cuthbei

[joris]

Originally Posted by mcnallym

Use an Address Range and use that as the NAT for the Subnet that are translating. It will just use the next range in the IP range.

However looking at your requirement, is there any reason you cannot use a Hide NAT instead of an IP range to hide behind.

Because we have some devices behind the FW are doing electronic payments and the card company IPS does not allow xx payments in xx time from the same ip adress. That's why a hide pool for those device would do the trick.