top of page
Search

Check Point Hide NAT vs Static: fw tab -t connections When Return Traffic Vanishes

  • 3 days ago
  • 2 min read
Check Point network security troubleshooting lab
Check Point · Techclick CLI troubleshooting lab
Published server receives the SYN. Client never sees SYN-ACK. Access rule is accept.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Check Point for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

If the server is hide-NAT outbound and static inbound is missing or wrong, return packets leave with the wrong source. fw tab shows the NAT pair.

Why this ticket shows up

Check Point NAT is its own policy. Manual NAT order and automatic Hide can collide on the same server.

Symptoms operators actually see

  • SYN on the server, no return

  • xlate shows hide instead of static

  • Works on-net

  • Recent automatic NAT added

CLI first — copy this block

Run these on the Check Point device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

fw tab -t connections -u | grep 203.0.113.50
fw tab -t fwx_alloc -u | grep 10.9.9.20
fw monitor -e "accept host(203.0.113.50);"
natinfo 203.0.113.50

How to read that output

You want a static destination NAT to the server and a matching return. A hide xlate on that server for inbound is the smoking gun.

Triage order

  1. Find the connection and xlate

  2. Read NAT rule order

  3. Put the static server NAT above generic hide

  4. Install policy

  5. Retest from outside

Classic traps

What you see

Real cause

Fix

Open another accept rule

NAT is wrong

Fix NAT

Disable NAT on the gateway

Only this server is published

Fix one object

Blame the server default gateway

xlate already hides it

Fix xlate

Proof the ticket is closed

  • Static xlate present

  • Bidirectional counters

  • External client connects

Say this in an interview

I read the xlate before I argue about accept rules. Hide vs static explains most inbound black holes.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page