Checkpoint conversion - No sec policy to allow inbound NATs to public IP addresses

L0 Member

Checkpoint conversion - No sec policy to allow inbound NATs to public IP addresses

We had to back out our CKPT-PAN firewall migration last night when we discovered many converted NAT rules (bidirectional) had corresponding security rules, but only for the Internal IP address objects and not their corresponding external addresses.  Other internal zones could reach the servers in the DMZ and Apweb zones but external-to-internal connection attempts were not matching a security policy.  We discovered we had to clone each MT-tool-created policy, change the allowed address objects to their external addresses, and change the Source zone from Any to External.  Doing this to match each inbound NAT will take hours since some rules contain dozens of address objects.

We noted that for many of the converted address objects where the IP address is internal, the corresponding External address shows up in the Description field for the object.

Is there something better or different we could've done different with the tool or Checkpoint config for the needed inbound security rules to be created for all the bidirectional NATs?

L2 Linker

Re: Checkpoint conversion - No sec policy to allow inbound NATs to public IP addresses

Hello wroberts,

I had similar problem with Check Point - I believe a case here is that Check Point and PAN have NAT configured differently.

In Check Point you can set Manual Static NAT with Proxy ARP or you just simply configure NAT on the object itself.

On PAN, destination NAT must be configured by NAT and Security Policy taking into considerations Pre-NAT/Post-NAT Zones and Addresses. Since I had not so many rules in my migration project, I just manually edited them to transfer Check Point logic to PAN.

What basically tool is helped me with is to have a list of rules and objects so I can make sure that I got all of them transformed.

Sorry for not being really helpful here :smileysad:


Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!