Remote Management and NAT

[roadrunner]

Remote Management and NAT
There are situations where you may need to manage your firewall module from a management module subject to address translation. The actual SIC process works okay provided you configure the firewall module to use the NAT address for the management module.

On the management module, create an object of type Check Point host with the remote management's statically NATted IP address. If you are using manual NAT rules, this should already be done, though the object might be a normal workstation object. If so, delete the object and recreate it as an object of type Check Point host. In the Installed Products section of the General frame of your new Check Point host object, select Log Server.

Next, you will go into the gateway object definition. Go to the appropriate gateway object on the management station. Select the Masters frame under Log and Alert. Select the option Use local definitions for Masters. You will get a warning about this affecting the Additional Logging frame as well. Select yes. Install the security policy.

On the firewall module, do a cpstop. Edit the file $FWDIR/conf/masters, which will look something like the following:

[Policy]
snuffleupagus
[Log]
snuffleupagus
[Alert]
snuffleupagus
Change all three instances of your management module object (snuffleupagus in this example) to the new Check Point object you created previously. Now type in cpstart to bring up the firewall module. It should correctly log to the management module using the NAT address, and the management station should be able to push policy to the firewall module without problems.

-- PhoneBoy - 16 Mar 2004


FAQForm
FAQs.Class: NetworkAddressTranslationFAQs, RemoteManagementFAQs
FAQs.OS:
FAQs.Version: