NAT Issue with SecureXL

[ba3113]

I am running R77.30 VSX Gateway on open server.When I have NAT Policy with SecureXL enabled the NAT Translation does not work.If I disable the SecureXL the NAT Translation works.
Has anyone come across with this situation and how it can be resolved ?

[laf_c]

I am running R77.30 VSX Gateway on open server.When I have NAT Policy with SecureXL enabled the NAT Translation does not work.If I disable the SecureXL the NAT Translation works.
Has anyone come across with this situation and how it can be resolved ?

That's odd. How did you find this out? Just user experience or some logs?

[ba3113]

We are doing some feature testing on R77.30 and found this problem

[jdmoore0883]

Could the issue be related to the traffic you are testing? What, exactly, is the issue at hand? What kind of traffic is involved? How do you see that NAT is not taking place?

[cciesec2006]

Could the issue be related to the traffic you are testing? What, exactly, is the issue at hand? What kind of traffic is involved? How do you see that NAT is not taking place?

I remembered running into a similar situation like this one as well.

I was testing "hide" NAT with SQLnet, both client and server hosts are Linux. I remembered that with SecureXL enable, sqlnet didn't work. When I turned off SecureXL "fwaccel off", sqlnet starts working again.
I think I was testing at the time was just R77.30 with no HFA.

I was just testing out R77.30 at the time so I didn't open a TAC case.

Try to apply the latest HFA (I sound like Checkpoint) and see if you still have issues :-)

[ba3113]

I am running Jumbo fix Take_185.Its normal HTTP,DNS and ping traffic.

[jdmoore0883]

How are you seeing that NAT is not taking place? What NAT rule should be applied to this traffic?

[ba3113]

Yes Nat is not applying to traffic when SecureXL applied.I have simply configure Automatic Nat , static Nat , Manual Nat (Static , dynamic , PAT) I have tried all combination of NAT but NAT does not work.
Moreover if I create manual NAT but its does not work at all even SecureXL disabled.The firewall not doing Nating.

SecureXL enabled
============
When I enabled the Tcpdump on egress and ingress I can see traffic going through firewall and has firewall interface mac address.The Traffic is without Natting.
When I enabled the FW Monitor it not showing anything into capture.Its not showing single flow of chain module.

SecureXL Disabled
============
When I enabled the Tcpdump on egress and ingress I can see traffic going through firewall and has firewall interface mac address.The Traffic is without Natting.
When I enabled the FW Monitor it showing traffic into capture and showing all chain module in flow.

[ba3113]

Yes Nat is not applying to traffic when SecureXL applied.I have simply configure Automatic Nat , static Nat , Manual Nat (Static , dynamic , PAT) I have tried all combination of NAT but NAT does not work.
Moreover if I create manual NAT but its does not work at all even SecureXL disabled.The firewall not doing Nating.

SecureXL enabled
============
When I enabled the Tcpdump on egress and ingress I can see traffic going through firewall and has firewall interface mac address.The Traffic is without Natting.
When I enabled the FW Monitor it not showing anything into capture.Its not showing single flow of chain module.

SecureXL Disabled
============
When I enabled the Tcpdump on egress and ingress I can see traffic going through firewall and has firewall interface mac address.The Traffic is with Natting.
When I enabled the FW Monitor it showing traffic into capture and showing all chain module in flow and traffic is getting NAT.

[varera]

What kind of NAT is this? Hide, Static? manual, automatic?

[ba3113]

I tried all combination of Nat (Static , Hide) with Automatic and Manual.Manual NAT does not work at all but Automatic Nat work when disable SecureXL.

[ba3113]

I have tried same secnario in R77.20 and looks like all NAT works (Automatic and manual) without any issue even SecureXL enabled so it means something not right with R77.30. Probably need some hotfix which are due to release.

[varera]

I tried all combination of Nat (Static , Hide) with Automatic and Manual.Manual NAT does not work at all but Automatic Nat work when disable SecureXL.

Why manual NAT did not work? Are you NAT-ing behind an IP that does not belong to a FW?

[ba3113]

I have tried two address range one is belong to FW subnet and one is not belongs to but does not work in R77.30 but this combination works in R77.20

[varera]

I have tried two address range one is belong to FW subnet and one is not belongs to but does not work in R77.30 but this combination works in R77.20

Interesting. I suspect a config issue here from the start. Can you get more details about how you configure those ranges. Let's start with Automatic NAT hide.

[ba3113]

External connection has 192.168.0.0/24 Subnet
Internal Connection has 192.168.10.0/24 & 192.168.11.0/24 Subnet
I have a windows Server with address 192.168.10.24.I have enabled the NAT under node object and use Hide Behind Gateway Address and apply policy.If SecureXL disabled it works.If SecureXL enable it does not work.
I enabled Hide Behind Gateway for the same object and hide address is 192.168.0.24 or 192.168.14.24 and apply policy.If SecureXL disabled it works.If SecureXL enable it does not work.

If I use same config in R77.20 they works without any issue.

[varera]

Thanks. Seems to be a bug after all. I would advise you to open a support case with Check Point.

[matt.taber]

Was there ever a resolution from Checkpoint? We're seeing the very same issue on a fresh install of R77.30 on new hardware that we restored a previous configuration from old hardware.

[matt.taber]

Was there ever a resolution from Checkpoint? We're seeing the very same issue on a fresh install of R77.30 on new hardware that we restored a previous configuration from old hardware.

During the restore of configurations onto the new hardware, it was advised by a CP SK article to bypass the 1st time configuration wizard. While doing that, everything appeared to be installed correctly. When we went to run 'cpconfig' to reset SIC, we were prompted w/ the CLI version of the EULA and 1st time config wizard. We ran the 1st time wizard and everything configuration wise was still in tact after the wizard completed. We ran into many strange connectivity issues. We ended up rebuilding each of the firewalls, running the 1st time wizard, THEN restoring from backup. Once complete, we no longer had any of the weird issues, specifically the issue with NAT not working with SecureXL enabled.