one (public ip) to many (different internet servers) port mapping question

[dungkaitai]

The version I am using is R62.
The checkpoint can to one to many port mapping, but the public IP is the one that checkpoint is using?

How to set one to many port mapping on extra public IP?
example: 1.1.1.1 (checkpoint WAN IP),
1.1.1.2 (another public IP)
and 1.1.1.2 port 80 map to internal web server 192.168.0.1
1.1.1.2 port 25 map to internal mail server 192.168.0.2

This is possible with Netscreen, any ideas about Checkpoint?

[sail4fun]

Can do, manual nat, Service aso.

[MarioL]

example:

any | firewall IP | http | = | internal web server IP | =
any | firewall IP | smtp | = | internal smtp server IP | =
...
Then you need a Hide NAT rule and that should be it. BTW, you can also use the SMTP security server for the SMTP bit and that would add additional security. In that case you would use no NAT, simply create a SMTP resource that would direct mail to the internal server.

[dungkaitai]

Thanks for reply.

Sorry, I have typing mistake in my first post.

My question is:

Checkpoint can do one to many port mapping, but can the public IP NOT the one that checkpoint is using ?
(eg. two pubic ip, one public ip is the checkpoint interface/management ip, another public ip is for port mapping to different internal host).

[dsb.nepo]

This is even possible with static nat.

For Example say your ext. Network is 192.168.2.1/29
Firewall IP: .2, mac address 01:02:03:04:05:06 (unix/splat)
IP for nat: .3

with this trick you can have manual nat without manual routing at the gateway, even there is not need to enable proxy arp at the external interface.

edit/create the file /opt/CPsuite-R62/fw1/conf/local.arp

192.168.2.3 01:02:03:04:05:06

go in SmartDashboard to
[Policy]
[GlobalProperies]
[Nat - Network ...]
enable Merge manual proxy arp

create object with NewObject.IP3

create rulebase

extern | NewObject.IP3 | smtp | allow
extern | NewObject.IP3 | http | allow

create incoming nat rulebase:

extern | NewObject.IP3|smtp || = | smtp server (static) | =
extern | NewObject.IP3|http || = | web server (static)  | =

outgoing nat rule:
....

push the policy, test ...