Checkpoint On NT 4.0

That depends on what you mean by proxy server. The answer to your question is no, it won't act as a proxy server.

A proxy server intercepts packets, creates new packets from the information, sends the new packet to the original destination andthen performs the same events in reverse for the response. While checkpoint has some proxy capabilities it is not a proxy server. It is a packet-filtering firewall with NAT capabilities (and some proxy characteristics).

You will be able to run NAT on the Gateway and all your local workstations will communicate on the internet but it is not technically a proxy server.

If your question comes from confusion between a proxy server and a NAT server/firewall then I would recommend reading upon the difference.

The short answer to your question is no. CheckPoint VPN-1/Firewall-1 will not function as a proxy server, although it can perform similar proxy functions

There is no "break" in connection between the source machine and the destination system. CheckPoint implements stateful inspection technology which basically means that the inspection engine will examine the packets within the datastream connection at each layer of the OSI model. Based on the rules defined within the CheckPoint rulebase and the content of the packets within the datastream, the connection will be either permitted or denied. The CheckPoint inspection also keeps track of session information, and hence can determine that an incoming ftp connection for example can be permitted provided that it can be matched to an outgoing FTP session. In this way two connections rules do not have to be define.

A proxy server on the other hand does not permit the source system to connect directly to the destination system. In actual fact, the source system will make a request to the proxy server, which will then establish a coonection between itself (the proxy server) and the destination system. Hence the term proxy.

As you can see, there is only one connection whenusing VPN-1/Fw-1 (source -> destination)
but when connecting through a proxy server, two connections exist (source -> proxy server) and (proxy server -> destination).

You can however, configure CheckPoint VPN-1/FW-1 to implement NAT, a feature of a proxy server. This allows you to hide all internal ip addresses behind a valid external ip address that is either the actual firewall address or (what is normally the case) a secondary external valid ip address which is arped onto the external firewall ip address.

Hope this Helps.