CPUG

The Check Point User Group

A Resource For The Check Point Community.  Fast.  Useful.  Independent.

1. CCSA/CCSE One-Week Dual-Certification Training Course with CPUG in San Francisco!
    Courses Starting 12/8, (2009) 1/19, 2/9, 3/9, 4/6, 5/4, 6/8, 7/6, 8/3.
2. Join Us On LinkedIn - We now have a CPUG group.


Go Back   CPUG: The Check Point User Group > Check Point Firewall-1/VPN-1 And Related Products > NAT (Network Address Translation)
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 2007-10-03
Junior Member
 
Join Date: 2007-05-17
Posts: 27
Rep Power: 0
Startrek4u has an average reputation (10+)
Default FW Using Incorrect NAT Rule?

Ok, so here is my configuration, off of our FW we have a number of subnets which are used for private connections to various partners of ours. They are numbered as follows: 192.168.201.X, 192.168.202.X, etc. For these connections I have NAT rules setup to do no translating of the internal address, so when traffic comes from 192.168.1.X (internal) it looks that way to the next hop as well. For one of these connections the final address is a 170.132.X.X address scheme, I have the routing set to send any traffic destined for this network to the next hop (192.168.201.2). However, the party looking at the device on the other end say they see our Public IP coming into their device. I'm confused as to why that is, the no-NAT rules for this are number 3 and 4 (ie no-NAT from 192.168.1.X to 192.168.201.X), the automatic NAT Rule for the public IP much lower in the list.

I don't suppose anyone has any suggestions or know what I can do to fix this?

Thanks
Reply With Quote
  #2 (permalink)  
Old 2007-10-05
Junior Member
 
Join Date: 2007-10-01
Posts: 6
Rep Power: 0
bglass has an average reputation (10+)
Default Re: FW Using Incorrect NAT Rule?

You say that the NAT rule is "no-NAT from 192.168.1.X to 192.168.201.X" but you mention that the final address as a 170.132.X.X network.

The NAT rule you mentioned above would not match a connection from 192.168.1.x going to 170.132.x.x and would therefore match your Automatic NAT rule hiding it behind the public IP.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT -7. The time now is 13:36.


Powered by vBulletin® Version 3.7.4
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.2.0