topic Check Point Automatic NAT Conversion in Expedition Discussions

Check Point Automatic NAT Conversion

mb_equate — Thu, 06 Jan 2022 00:36:43 GMT

Expedition: 1.2.3

Source configs: Check Point R80.30 HFA236

Target configs: Panorama / PAN-OS 10.1.3

Has anyone had success [easily] converting Check Point automagic NATs in Expedition? I've had to manually modify both static and hide NATs and create new objects for the translated addresses as the imported rules reference the original object ("valid address" in CP speak) because no explicit object exists for the translation.

I've reached a point where I can no longer select an object for a DIPP translated address - even the original object in the rule doesn't appear in the dropdown:

I can't work out where I've gone wrong, as the same objects are available in the original packet source field:

Some things to note...

The CP policy, when imported, appears in a vsys or device group "Management server-[policy_package_name]"
The CP objects appear in a different device group "[policy_package_name] Security"
- Why the different device group?
- Naturally the objects in the policy are orphaned and cannot be referenced until they are converted to Shared
New objects are created in the device group selected in the Dynamic Toolbar
- As above, objects must be converted to Shared if not created in the same device group as the policy

Any ideas?

Re: Check Point Automatic NAT Conversion

mb_equate — Thu, 06 Jan 2022 00:47:29 GMT

Update: I've been able to reference new objects created in the same device group as the policy, just not shared, and this only applies to the Translated Address field for DIPP rules (statics are not affected).

Re: Check Point Automatic NAT Conversion

mb_equate — Thu, 06 Jan 2022 00:54:25 GMT

Update 2: Solution! If the referenced object is not in the same DG as the policy (e.g. Shared), "all" must be selected in the dynamic toolbar for those objects to be visible (again only for DIPP translated addresses).

There is one minor limitation though - Multi Edit does not work in the "all" device group so such rules must be manually edited.

Bug I reckon.