Check Point Automatic NAT Conversion

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Check Point Automatic NAT Conversion

L3 Networker

Expedition: 1.2.3

Source configs: Check Point R80.30 HFA236

Target configs: Panorama / PAN-OS 10.1.3

 

Has anyone had success [easily] converting Check Point automagic NATs in Expedition? I've had to manually modify both static and hide NATs and create new objects for the translated addresses as the imported rules reference the original object ("valid address" in CP speak) because no explicit object exists for the translation.

 

I've reached a point where I can no longer select an object for a DIPP translated address - even the original object in the rule doesn't appear in the dropdown:

mb_equate_1-1641428544550.png

 

I can't work out where I've gone wrong, as the same objects are available in the original packet source field:

mb_equate_2-1641428665612.png

 

Some things to note...

  • The CP policy, when imported, appears in a vsys or device group "Management server-[policy_package_name]"
  • The CP objects appear in a different device group "[policy_package_name] Security"
    • Why the different device group?
    • Naturally the objects in the policy are orphaned and cannot be referenced until they are converted to Shared
  • New objects are created in the device group selected in the Dynamic Toolbar
    • As above, objects must be converted to Shared if not created in the same device group as the policy

Any ideas?

1 accepted solution

Accepted Solutions

L3 Networker

Update 2: Solution! If the referenced object is not in the same DG as the policy (e.g. Shared), "all" must be selected in the dynamic toolbar for those objects to be visible (again only for DIPP translated addresses).

 

There is one minor limitation though - Multi Edit does not work in the "all" device group so such rules must be manually edited.

 

Bug I reckon.

View solution in original post

2 REPLIES 2

L3 Networker

Update: I've been able to reference new objects created in the same device group as the policy, just not shared, and this only applies to the Translated Address field for DIPP rules (statics are not affected).

L3 Networker

Update 2: Solution! If the referenced object is not in the same DG as the policy (e.g. Shared), "all" must be selected in the dynamic toolbar for those objects to be visible (again only for DIPP translated addresses).

 

There is one minor limitation though - Multi Edit does not work in the "all" device group so such rules must be manually edited.

 

Bug I reckon.

  • 1 accepted solution
  • 2791 Views
  • 2 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!