[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [FW-1] SecuRemote IP Pool NAT on the same subnet NG FP2 WIN2K
Hi all, >From Check Point's knowledgebase, IP Pool NAT on the same subnet as one of the firewall's interfaces cannot be done unless we implement a method using proxy arp. The firewall's internal interface has the following network parameters: IP: 192.168.1.1 Mask: 255.255.255.0 I tried using proxy arp by doing the following: 1. Created a "smaller" subnet of the current "bigger" subnet in the firewall policy as a Network object called "smaller_net". eg. "Bigger" subnet: 192.168.1.0 (255.255.255.0) "Smaller" subnet: 192.168.1.128 (255.255.255.128) 2. Created a local.arp file in $FWDIR\state with all the IP Pool NAT addresses to match the firewall's internal MAC address: eg. 192.168.1.129 00-50-56-C0-00-09 192.168.1.130 00-50-56-C0-00-09 . . 192.168.1.254 00-50-56-C0-00-09 3. Removed Automatic ARP configuration from the Global Properties Settings since Secureknowledge highlighted that Automatic Arp does not support proxy arp. 4. Configured IP Pool NAT to use the "smaller_net" network object defined in No.1 as well as other necessary SecuRemote configurations. 5. Installed the policy and rebooted the firewall After that I tested the SecuRemote connections again. >From the VPN logs, I could see that the VPN connection succeeded, and I was assigned an IP Pool NAT address of 192.168.1.129; however, I could not ping any servers in the 192.168.1.0/24 network. I used a sniffer to check the packets and saw that nobody is responding ARP requests for 192.168.1.129. This means that the firewall STILL does not know how to respond to ARP requests to the IP Pool NAT addresses even when proxy arp has been set. I ran the "fw ctl arp" command and the message "No Proxy Arp addresses" were displayed. Did I configure the proxy arp wrongly? Thanks in advance. Cheerios, Vic __________________________________________________ Do You Yahoo!? Yahoo! Finance - Get real-time stock quotes http://finance.yahoo.com ================================================= To set vacation, Out Of Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
|