use broadcast address as NAT address

[ruban]

Can i use a broadcast address at NAT address on Check Point NGX f/w


the scenario is like this below :

router connectivity ---------> switch(xxx)134.251.255.173 --------> (NGX check point f/w) 134.251.255.174----------(Internal hidden server) 172.31.223.234

The Network address segment available for me to NAT is --> 134.251.255.172/30

Can i used a broadcast network address -> 134.251.255.175 as a NAT address to NAT my internal server(172.31.223.234).


Appreciate your feedback and suggestions. Thanks

[MarioL]

I'm sorry but some of the IPs you put there are confusing me a bit. So I'm just going to give you a generic answer. Also, ideally you shouldn't NAT directly to LAN, servers that need direct inbound access from the Internet should be on a DMZ.

If you have a /30 subnet, if you use the BC address for NAT you will have problems. There is a reason why the BC address exists. An exception is if that network isn't being used, but rather routed to the firewall for NAT purposes specifically in which case you could use all 4 addresses, including the Network one.

If I was you, I'd just create manual NAT, using the firewall address as the public address for the internal server, for specific ports.

Example:
You have an internal Web server that needs to be access on port 80.

Create 2 objects for the server, one with the internal IP and another with the firewall's external IP.

Create 2 manual NAT rules as:
Any | FW IP | http --> = | Server IP | =
Server IP | any | any --> FW IP hide | = | =

That should do it. It also allows the server to go out to the Internet hiding on the FWs IP. If you already have a Hide for the LAN, the 2nd rule might not be needed.

Hope that helps.

[olasoji]

If you have 134.251.255.172/30 as your network, then I am afraid, you cant use the broadcast address 134.251.255.175 as NAT address for an internal device as it wont make sense to your ISP's network.

The two useable addresses you have have been used up. You may need to talk to your ISP to give you more flexibility on public addresses.

I hope this solved your problem.

Cheers