How NAT works in FireWall-1 NG

[BarryStiefel]

How NAT works in FireWall-1 NG

Contributed by PhoneBoy
Published in geeklog Saturday, May 17 2003 @ 05:06 AM EST
Published in oldfaq 2002-Nov-10 00:03 dwelchATphoneboyDOTcom



NAT has changed quite a bit since FireWall-1 4.1. In 4.1 and earlier releases, NAT happened on the server side, meaning that a packet enters the firewall, passes the inbound anti-spoofing and rule checks, gets routed, passes the outbound anti-spoofing and rule checks, then gets subject to NAT. The affect of this is that you must have a proxy-arp for each NAT address and a static route for each destination static NAT address.

In NG, NAT happens on the client side if the appropriate property is enabled and automatic NAT rules are in use. This means a static route isn't necessary. Proxy-arps can also be handled by FireWall-1 automatically. Both properties to enable these features are in the Global Properties, NAT frame. If you prefer manual NAT rules, an objects.C property called 'nat_dst_client_side_manual' is supposed to allow client-side NAT with manual rules. In dbedit, enter the following commands:

modify properties firewall_properties nat_dst_client_side_manual true update properties firewall_properties


Reload the security policy.

Check Point did not make a GUI for this prior to FP3 because it doesn't work well for dual NAT situations (changing both source and destination IP). In NG FP3, it works correctly and there is a GUI entry for this property in the same place as the others.

-- RayLodato - 07 Jan 2004

FAQForm FAQs.Class: NetworkAddressTranslationFAQs FAQs.OS: FAQs.Version:

[odomae]

I have a linux VPN client sitting behind a CP box(configured as a NAT router) trying to establish tunnel with a R60 gateway. But IKE phase 2 fails.
I get this error " UDP encapsulation tunnel not supported". No proposal chosen for quick mode.

What does this mean?

The IKE is successfull if I turn off the NAT-in inbetwen..