Skip to main content
ck8882
Explorer
April 18, 2023
Question

Central NAT - Different source, same destination with different Ip pool.

  • April 18, 2023
  • 4 replies
  • 2136 views

hi, i do have central nat problem for pointing same destination with different ip pool

 

in my case, there is configured different source, same destination with different Ip pool. However the result look no good. 

 

for example, i tried use 2 machine for test, each assign to use different ip pool for SNAT. But only 1 workstation able to reach the destination with the ip pool, the other one unable reach at all.

 

i tried swap the sequence the rules, also no luck. 

 

anyone have the idea? would it because snat session only allow occupied by 1 workstation. sound doesn’t make sense. 

4 replies

adambomb1219
SuperUser
SuperUser
April 18, 2023

Why not use Policy NAT?  

ck8882
ck8882Author
Explorer
April 19, 2023

It's migration from checkpoint to FGT. That why It's best to central NAT. There is 200 NAT and 200 Policy. If using policy nat, there will double up the policy and not easy to migrate and took time.

 

That why would like figure out whether does FGT central nat support scenario or it's bug or missing need some config for above.

adambomb1219
SuperUser
SuperUser
April 19, 2023

Boo, firewall migration though is not really a best practice, neither is central NAT.  Also using policy based NAT would be half the amount of the configuration, not double since you aren't making separate NAT Rules for traffic.  The NAT statements are contained within your existing firewall policies.

This is an exact use-case why I never recommend using firewall migration tools.  Old items from old firewalls are brought forward to a shiny new firewall, un-used rules, etc etc

gfleming
Staff
Staff
April 19, 2023

Can you show the rules you have?

ck8882
ck8882Author
Explorer
June 1, 2023

HI Guys,

 

I found the solution and fix it. Thanks