Checkpoint NG management -- behind NAT?

Also, I need some kind of configuration guide on how to set this up. So far, I haven't been able to get the management console to push policies to the firewalls when management is NAT'd.

Point value changed by question poster.

I am not sure if this article on Checkpoint's site will be helpful, but it might:
https://support.checkpoint.com/public/idsearch.jsp?id=sk12120
(please remove any spaces)

I am gonna check the NG FP2 cd for any useful info, and will post it if Ifind anything.

Sites that may provide helpful info
1)http://education.netstuff.ch/site/int932675/sup796567/200673687161

Here's a 68 page guide that I hope helps:

http://www.opsec.com/solutions/partners/downloads/fireproof_setup_guide.pdf

NAT specific info is on pages 27-31.

I'm not sure why you need a static NAT for the mgmt station?

The way we set ours up is that we have a seperate mgmt lan that no one can access. And the fwl is also part of that netwk.

Then we just allow in the policy editor for policies to beapplied from that address.

Another question, when you registered the license, you should of have had to specify the mgmt console station. Once you specify that address, it can not be changed unless you relicense.

On a techincal note, I am notsure how checkpoint will react to a nat'd mgmt station. It may see it as a spoofed address and reject the policy.

I may be off the track here or missing something in the question, I am more of an IT generalist than a specialist (knowledge in many areas but not extreme depths). However, I am used to seeing security and network management servers in the DMZ. All the machines in the DMZ should have a different IP address group to the general network (ie DMZ 192.168.0.xxx, network 10.0.xxx.xxx), and I am used to seeing the DMZ machine IP addressess being static. This is because you want to ensure that they relevant traffic ALWAYS goes to the proper place, especially the traffic for the management machines.

The Network Address Translation (NAT) activity should occur properly regardless of the IP addresses being static or dynamic. The NAT machine should be at the front of the DMZ, between the bulk of the DMZ and the Internet and thus what is happenening behind it is irrelevant to the NAT machine.

As to the set up procedures, they should be in the relevant manuals and I cannot give you a blow by blow description there.

Hope this helps you with your intended network layout.

After looking through everything I could find, I determined that there is no reason why the NAT'd station shouldn't talk to its firewalls, so I broke down and called support. Although they didn't say it, obviously there is a bug (big surprise, NOT).The workaround: create an object with the public IP address and make it a secondary management station and log server. Make the new object the Master and Log server via the management GUI on NG firewalls (if you have 4.1 firewalls, run cpconfig to set up the masters). Put in a static NAT rule to direct all traffic from public IP to private IP on the management station. Push the policy to all, and it seems to work.

This question was closed by the author

A note for those of you thinking about moving to NG: it adds a number of nice features, but finding help and info on it is more difficult than 4.1. Surprising, since NG has been out for quite a while. Phoneboy's web site and book are great for 4.1, for example, but he has no book on NG and the web site doesn't address NG nearly as thoroughly as it does 4.1. Most of the books I find on NG are so-so. NG is very different in a number of areas, different enough that knowing how to do something in 4.1 is often no help in NG.