> Source: [sk113163](https://support.checkpoint.com/results/sk/sk113163)

# sk113163 - NAT rule installed on cluster does not hide the Source IP address behind the configured IP address if the packet is sent to Cluster VIP address

| Property | Value |
|----------|-------|
| Solution ID | sk113163 |
| Date Created | 2016-09-01 |
| Last Modified | 2017-05-17 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * NAT rule on cluster does not translate the Source IP address in the following scenario:

  1. Topology:  

     \[Some Host #1\] --(some network)-- ethX \[Cluster\] ethY {Host #3} --(some network)-- \[Some Host #2\]  

     Traffic from Host #1 towards Host #2 has to be hidden behind some IP address (represented as Host #3)  

     Example: Connecting with SmartConsole GUI clients through Cluster to Security Management Server

  2. The following NAT rule was defined:

     |---------|---------------------------------------------------------------|--------------|-------------|-------------|--------------|----------------|
     | ORIGINAL PACKET                                                                      ||| TRANSLATED PACKET                      ||| INSTALL ON     |
     | SOURCE  | DESTINATION                                                   | SERVICE      | SOURCE      | DESTINATION | SERVICE      | INSTALL ON     |
     | Host #1 | Host object that represents **Cluster VIP address on *ethX*** | Some Service | **Host #3** | Host #2     | `= Original` | Cluster object |

  3. The packet is sent from Some Host #1 to Cluster VIP address defined on ethX.

  4. Only the Destination IP address is NATed.

* NAT rule on cluster does not translate the Source IP address in the following scenario:

  1. Topology:  

     \[Some Host #1\] --(some network)-- ethX \[Cluster\] ethY --(some network)-- \[Some Host #2\]  

     Traffic from Host #1 towards Host #2 has to be hidden behind Cluster VIP address (defined on cluster's ethY)  

     Example: Connecting with SmartConsole GUI clients through Cluster to Security Management Server

  2. The following NAT rule was defined:

     |---------|---------------------------------------------------------------|--------------|---------------------------------------------------------------|-------------|--------------|----------------|
     | ORIGINAL PACKET                                                                      ||| TRANSLATED PACKET                                                                        ||| INSTALL ON     |
     | SOURCE  | DESTINATION                                                   | SERVICE      | SOURCE                                                        | DESTINATION | SERVICE      | INSTALL ON     |
     | Host #1 | Host object that represents **Cluster VIP address on *ethX*** | Some Service | Host object that represents **Cluster VIP address on *ethY*** | Host #2     | `= Original` | Cluster object |

  3. The packet is sent from Some Host #1 to Cluster VIP address defined on ethX.

  4. Only the Destination IP address is NATed.

## Cause

When a packet is sent to Cluster VIP address, an internal NAT is performed (Fold) to translate the Destination IP Address from Cluster VIP address to Physical IP address of the relevant cluster member.  
This internal cluster NAT currently does not perform any NAT on the Source IP address.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content