Checkpoint Firewall question

I have a Checkpoint firewall that I am installing.  It has 3 nic cards.  I want to set it up so that it performs network address translation for an entire network ( and also performs a couple of static mappings for a specific machine (ex. maps to  Can I do both?  Or will Checkpoint only allow me to either go static or dynamic.  If I can, how is it done?
Who is Participating?
geoffrynConnect With a Mentor Commented:
Just define another network object for the remote subnet and create an allow rule.  The Checkpoint will also need a static route to the remote network.
This is easy and I will try and help.  First, most of all your question can be answered at
Now to address what you want to do.  I would recommend never doing automaticic translations, that means never use the NAT tab on network object properties.  In policy editor do all translation right there on the Address translation policy tab.  To do what you want follow this guidelinel

create an workstation object int-host-1-int
give hime IP address

create an workstation object int-host-1-ext
give him IP address

create an network object int-network-1
give it the IP network

create an workstation object int-network-1-hiding
give it the same ip address as the external interface of the firewall  *note: checkpoint will give you are warning message that you are giving two objects the same IP address, this is okay just click okay.*

Now create the following translation rules.
Source    Destination Serv Source      Destination    Serv
any    int-host-1-ext any  orig.       int-host-1     any
int-host-1  any       any  int-host-1-ext  orig.      any
int-network-1   any   any  int-network-1-hiding orig. any

If you can't read that I am sorry very limited in what can be done here.  If you need a screen shot , give me your email and I will send one.

Also, you have to make sure the firewall answers for the static address you just assigned it to translate.  The best way to do that is to make sure by putting a static arp entry on the external router that the firewall connects to for it's internet connection.
something like this in cisco:

config t
arp (MAC address of firewall)

If you can't do this then you need to do it on the firewall, only problem is if there is a switch in between the firewall and the external router sometimes the switch won't like it and the router wont be able to send traffic destined for to the firewall.

Besides that you are all set.
Let me know if you need the screen shot to better understand, but it is very simple to setup.
SilasAuthor Commented:
this is good info -I just had one other question regarding the NAT functionaility on checkpoint.  Can you NAT a remote network, i.e. one that is not directly connected to one of the Checkpoint interfaces.  I have 2 routers, one going to the Internet, one going to a remote network -but that remote network needs to be natted as well, so it can reach the web.  In Cisco, we would create an access list that would be used for NAT purposes, specifying local and remote networks (or everyone).  Can I do the same thing here?
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

As long as the traffic from the remote office passes through the checkpoint firewall it can be NATed.

Give my an idea of your network layout and maybe I can suggest a best practices kind of thing.  I have this exact kind of thing setup all over the world on firewalls I manage.
SilasAuthor Commented:
here is a crude diagram

-------Cisco 2621--------
         Switch----------Cisco 2501
            |                 |
      Local Network       Remote Network (different subnet)

So the Checkpoint needs to be able to recognize packets coming from the remote network via the 2500 series router and send them to the Internet as well.

SilasAuthor Commented:
Cool -thanks -I am also posting another question regarding Checkpoint, if you could help me that one...
geoffryn's answer is wrong, he is missing something you shouldn't accept answers so quickly.
You asked how to setup NAT for another network.  He created an object and gave reference to setting up a rule to allow the traffic from that network, but that isn't only an imcomplete answer it's not even the best way of doing it.

The best way of doing this is to create a group object, then create Network objects for all your internal networks then put all the newly created network objects into the group object you created for internal networks.  Then create your rule base allowing those groups out.  Then, make sure you create a translation rule like the one I listed above except instead of an int-network object to any translated to int-network-ext remove the int-network-int object and insert the group container that you created that holds all internal networks.

Thats the easiest way of doing things.  The best way would be to put the router off the Third port of your firewall so you can have some protection so you have a firewall seperating all three locations: internet, site 1 and site2.
SilasAuthor Commented:
jwalsh88: Looking at the rule you have defined above, could I also create 2 network objects

1. GroupWise-Ext:
2. GroupWise-Int:

and set up a rule specifying the destination GroupWise-Ext and translated destination GroupWise-Int with a service of TCP 25?  Or does the name have to match?
Silas not sure I understand your question, why don't you just let me know exactly what you want to do and I can tell you what you need to setup to get it done.
SilasAuthor Commented:
I want to do a port address translation to an internal GroupWise server:

ex: 110 maps to 110

pretty straigtforward, I just don't like working with restrictive GUIs.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.