Connection contains real IP of NATed address

[BarryStiefel]

Connection contains real IP of NATed address



Contributed by msjouw
Published in geeklog Thursday, December 04 2003 @ 07:23 AM EST

Question



Hi,

I've run into a strange problem with a clustered pair of Nokia IP350's that are told to get the time from a timeserver on the local lan. No NATting is done whatsoever, the firewall setup is used on the internal network only. When either of the Nokias tries to pickup the time form the timeserver the log shows an entry that says dropped with this reason: Connection contains real IP of NATed address.

It does NOT show the Cluster address but the node address. This problem also occurs on other UDP protocols run from either of the nodes, like DNS.

It is not a real life depending emergency; more a major annoyance.

IPSO 3.7 build 26 clustering

Checkpoint NG FP3 HF2 ClusterXL in HA mode

Regards, Maarten.

Answer



Actually, the fact that you're not doing NAT is false. Connections originating from the firewall in a clustered configuration may originate from the cluster IP address. This isn't an explicit NAT rule, but a property in the Gateway Cluster object or Global Properties as I recall.

There are a couple of possibilities here:

1. Disable this NAT property
2. Add two "no NAT" rules in your NAT rulebase

-- PhoneBoy

-- RayLodato - 14 Jan 2004



FAQForm FAQs.Class: NetworkAddressTranslationFAQs FAQs.OS: FAQs.Version: