Network Address Translation and Routing
Core concepts
NAT on Check Point is configured in the NAT policy (separate from the security rule base) with Original and Translated columns for Source, Destination, and Service. Know Hide NAT (many-to-one, source translation, typically to the gateway's external IP) and Static NAT (one-to-one, bidirectional). NAT is applied automatically when a connection matches a NAT rule and passes the security policy - NAT does not itself permit traffic.
Routing basics
Understand the gateway's routing table, default route, and how traffic is forwarded. Know that NAT happens before routing decisions for translated traffic, and that return traffic must be handled consistently. Be aware of automatic NAT rules generated from object NAT settings versus manual NAT rules, and their order.
Traps in questions
- Thinking a NAT rule allows traffic - it does not; the security rule must also permit it.
- Forgetting that Hide NAT hides sources, so the destination sees the gateway IP; Static NAT maps one-to-one and is bidirectional.
- Mixing up which column (Original vs Translated) you edit.
- Assuming routing is unaffected by NAT - translated addresses change how return traffic is routed.
Worked example
Publishing an internal web server to the internet: create a Static NAT mapping the public IP to the private IP, then add a security rule allowing inbound HTTP to the translated object. Without the security rule, NAT alone drops the connection.