uni-directional nature of hide nat

[sebastan_bach]

hi all i have confiured hide nat on the network object to hide behind the gateway.

i have policies and all.

i have also put put a policy to permit from external network to internal network.

now i am trying to access the internal host on it;s actual ip address and it;s working.

is natting uni-directional in checkpoint.

cause in cisco or netscreen when we configure dynamic nat for internal hosts then from external networks u cannot reach the internal hosts on their actual addresses even though a policy permit it.

is this the way checkpoint dynamic natting works.

can someone pls confirm on this.

regards

sebastan

[chillyjim]

If the policy permits and the real IP address of the host is routeable, then this will work. It's really silly to "hide" a routeable IP address that you are allowing external connections to.

Hide NAT's are uni-directional in origination (Host outbound) static, or one-to-one NATs are by-directional in origination.

So, of my.host has IPA and a hide address of IPh

my.host connects to ftp.site the connection and return path will be on IPh

If outside.site tries to start a connection to IPh it will fail (This is the point of a stateful firewall)

Now if IPA is a routeable address and the policy permits, outside.site can connect to IPA.

If my.host is a static nat (The normal way of doing this) of IPA' then a connection to or from (Assuming policy allows) my.host is possible on IPA'

As for the PIX, before version 7, all connections were NATed. In some cases they were NATed to the same address (e.g. 4.2.2.2 inside 4.2.2.2 outside). This is a rement of the PIXes original function, to provide NAT.

If configured "correctly" you can achieve the same hide-outbound and don't translate-inbound on the PIX and ASA that you describe.

The real question is, what are you trying to accomplish?

[sebastan_bach]

hi jim thanks a lot for ur reply mate. i am not trying to accomplish anything . i have just started working with checkpoint. i have been only working on cisco for a long time . so was asking out whether i am getting it right the working of nat on checkpoint.

thanks for ur reply.

regards

sebastan

[mcnallym]

If the policy permits access to your internal network from the external network, and you actually have a route from the external network to the internal network then yes you can access the internal network from the internal network. As you are going to the actual IP of the internal box then you are not Natting when you do this.

Check Point has no concept of internal, external, or security level on the interfaces like Cisco does, which is why can do this on a Check Point, if the policy permits.

Remember however that normally from the Internet there will be no route to your private internal network, so isn't a real issue as normally you would not have a policy from external to internal network.

[sebastan_bach]

hi mate yeah u are right. the external router never has a route for ur internal network.

i got the point.

thanks

regards

sebastan