> Source: [sk113040](https://support.checkpoint.com/results/sk/sk113040)

# sk113040 - Network Static NAT is translating to an unexpected IP address

| Property | Value |
|----------|-------|
| Solution ID | sk113040 |
| Date Created | 2016-08-31 |
| Last Modified | 2019-04-03 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Only the network segment is being NAT'ed, host portion remains
* Each host IP in the original subnet is translated to a different IP in the translated subnet, not translated to the same host IP

## Cause

This is by design, static NAT will create a one to one NAT for the entire network you have chosen to nat only replacing the network segment

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk113040/natrule1608311534.jpg)

In this example, the Subnet Corporate-internal-net uses 172.16.1.0 with subnet mask 255.255.255.0 and the Host node DestNetwork uses 192.168.1.0

When matching this rule, the firewall assumes a like-sized subnet mask for DestNetwork, and uses the IP of the host object as the network IP.

For example, if this rule matched a packet from source IP 172.16.1.5, this NAT rule would translate the source IP to 192.168.1.5

If this rule matched a packet from source IP 172.16.1.100, this NAT rule would translate the source IP to 192.168.1.100

Unusual or unexpected behavior can appear when using different subnet mask lengths or unusual host IPs.

If we change the IP of DestNetwork to 99.99.99.99

Then the firewall still assumes a 24 bit subnet mask with the network IP of 99.99.99.99, which would make the broadcast IP for that subnet 99.99.100.98, and the network would have 254 host IPs.

In this example, if this rule matched a packet from source IP 172.16.1.5, this NAT rule would translate the source IP to 99.99.99.104

<br />

This is very unorthodox, but a valid configuration.

In most scenarios, the desired behavior would not be this, but to translate IP addresses which match the original network range to a single IP - in that case Hide NAT should be used instead of Static NAT.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content