Static NAT fails for outgoing connections through gateway with ISP Redundancy

[Newga]

Hi All:
I want to use double link to realize redundancy, the Active/Standby mode, by default to use one of the lines as the main line, but when the main problems and automatically switch to Backup line, internal host and network machine use manual Static NAT to realize and the external access!
Configuration of please give detailed configuration steps. Thank you!

[mcnallym]

sk25152 within the Check Point knowledgebase gives what is needed to configure for getting ISP Redunancy to work, once configured ISP Redundancy within the Object.

You also need to manually configure the Proxy Arp conifguration as you will be using Manual NAT Rules. sk30197 tells how to configure Manual Proxy Arp on SPLAT/Gaia. If on IPSO then can configure Proxy Arp via Voyager.

[Newga]

Thanks mcnallym!
I look sk25152,but I didn't understand dynamic_objects.I'll according this KB to test, and If I use hide NAT Everythings is ok,But ICMP not working,can you tell me why(single firewall)!

[mcnallym]

All the Dynamic Objects are used for is to represent the two ISP connections. The dynamic objects should be named the same as you label the ISP lines in the ISP Redundancy configuration.

If you use Hide NAT with ISP Redundancy then you should be set to Hide behind Gateway. When doing a Static NAT then will need to be done manually so you must configure the $FWDIR/local.arp file and then restart the gateway after ammending the file on the gateway. Otherwise the gateway does not respond to the reply traffic coming back.

Without knowing the rest of the configuration / policy etc then I would be guessing regarding the ICMP.

However is the rule that allows the ICMP traffic out logged?
If so what do you see in the tracker looking at the logs. If ICMP is allowed by the rulebase then should work fine once the ISP Redundancy is configured as per the sk.
If you do an fw monitor for the icmp traffic destination on the gateway then what do you see.
Also if you do an fw ctl zdebug + drop | grep dest+ip then do you see anything being dropped by the gateway.
If don't see anything being dropped then do a tcpdump on the external interface of the gateway to see if recieving a reply back from the icmp target.

If you see the traffic go out but not come back then sounds like an arp issue and you need to ensure that the local.arp is configured for the ip that natting behind.

Under the Policy / Global Properties then under NAT ensure that the merge manual nat option is ticked immediately beneath the automatic arp option.