> Source: [sk107543](https://support.checkpoint.com/results/sk/sk107543)

# sk107543 - "Invalid Object in Source of Address Translation Rule #" when installing / verifying policy

| Property | Value |
|----------|-------|
| Solution ID | sk107543 |
| Date Created | 2015-09-03 |
| Last Modified | 2017-09-13 |
| Technical Level | General |
| Products | Security Management Server |
| Versions | R82.10, R82, R81.20, R82.20 |
| OS | Linux, Gaia |

## Symptoms

- * Scenario 1 When installing / verifying the security policy users see the following warning:  

  ```
  Installation Targets	Version	   Policy Type	        Details
  fw_cluster	        R7x.xx	   Network Security     Invalid Object in Source of Address Translation Rule #. The range size of Original and Translated columns must be the same.
  fw_cluster              R7x.xx	   Network Security     Policy verification failed.
  fw_cluster	        R7x.xx	   Network Security     Operation ended with errors.
  ```

* Scenario 2 Policy installation fails with "invalid object in original source of address translation rule xxx. the valid objects are: host.gateway. network. address range and route".

## Cause

Scenario 1

This is caused by trying to create a manual NAT rule which translates a whole network to a single IP while the NAT method is set to "Static".

The "Static" NAT method is for 1:1 translations only (host:host, network:network) whereas the "Hide" NAT method is for 1:many translations (host:network).

Scenario 2

That rule contains a Group of "Group with exclusion".

Group of type "Group with exclusion" is not supported in NAT rulebase

## Solution

Scenario 1

In order to hide a whole network behind a single IP, you need to use "Hide" as the NAT method. To change it follow this procedure:

1. Right-click the translated host.
2. Select "NAT method..." from the drop-down menu.
3. Choose "Hide".

![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1441218013464/NAT_Method1509021129.png)

![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1441218013464/NAT_Method_21509021129.PNG)

**Note:** You can tell which hide method is being used by looking at the lower-right side of the translated object. For "Static", there is a red "S"; For "Hide", there is a red "H".

Scenario 2

Delete the Group and rebuild it as "Simple Group" object.

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk107543/sk120418 issue with Group with Exclusion1709130118.jpg)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content