[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] RE: [FW1] ICMP Transit Error
Sounds to me like a routing problem. Can you draw us a network diagram and show us how your routing is set up? >From your description, I can't quite make out how your network is configured. Is the following correct? |External networks| |Internet| | | | | | Extranet FW | -- DMZ -- | Internet FW | | | | | | -- |Internal Netw.| -- | If you do not have NAT configured on the Extranet FW, problem #1 must be because traffic from the internal network to the DMZ, is routed through the Internet FW. I would change routing to make the Extranet FW the default gateway for the internal network OR change the NAT rules on the Internet FW so that traffic to the DMZ is not NATed. Problem #2? Another routing problem, it seems. Have you tried a traceroute to see if there is a routing loop somewhere? Cheers, Anders :) -----Original Message----- From: Thuan Pham [mailto:[email protected]] Sent: 5. juni 2001 02:42 To: [email protected] Subject: [FW1] ICMP Transit Error Hello All: I have an Extranet CheckPoint Firewall-1 that connects to a Cisco AS5300 pointing to external networks. On the CheckPoint Firewall-1 server, there are three interfaces: hme0 (connected to internal networks), hme1 (connected to the DMZ zone), and hme2 (pointing to the AS5300 which connects to external networks). There is no NAT running. Here are the problems that I encounter: 1. When I telnet to the DMZ workstation coming off from the hme1 interface of the Firewall-1 server, I am able to login in. However, my internal address is being NAT to a valid public routable IP address which has been set up on the Internet Firewall-1 that I currently have. 2. When I am in the DMZ workstation and try to ping a host on the other side of the external interface of the Firewall-1, I get the error message: ICMP Time exceeded in transit from <DMZ Interface IP Address on the CheckPoint Firewall Server> for icmp from SJ-TAC01 <DMZ Workstation IP Address> to daem01 <External Host IP Address> I have tried to change a few things but I have not been able to fix the problems. I would appreciate any comments that will be provided. Thanks, Thuan Pham ================================================================================ To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================================================
|