[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [FW-1] How to make a multicast packet to test it passingthroughFW-1?
Guangcheng Wen wrote: > > Hello, > Thanks a lot for your great help. > > crist.clark> You'd have to set up multicast routing on the firewall to do that. That's > crist.clark> a lot more complicated than just making a multicast packet. > > I have no idea howto set up multicast routing on a firewall. > The firewall manual said, > "Firewall 1 does not treat multicast as a special case, so for VPN-1/FireWall-1 > , a multicast packet is simply an IP packet with a class D (224.0.0.0 239.255 > .255.255) destination address." > > crist.clark> If you want to make a multicast packet, on a default install of Solaris > crist.clark> you can just, > crist.clark> > crist.clark> $ ping -I1 224.0.0.1 > crist.clark> > crist.clark> For real fun (if you have other Solaris systems on the LAN with the default > crist.clark> multicasting setup). A "ping 224.0.0.1" will also work fine on a Windows > crist.clark> box (Win2k anyway). > > I have just $ ping -I1 224.0.0.1 in the firewall(Solaris8) and got > the following message, > PING 224.0.0.1: 56 data bytes > 64 bytes from fwlb2 (192.168.2.254): icmp_seq=0. time=3. ms > 64 bytes from fwlb2 (192.168.2.254): icmp_seq=1. time=1. ms > 64 bytes from fwlb2 (192.168.2.254): icmp_seq=2. time=0. ms > 64 bytes from fwlb2 (192.168.2.254): icmp_seq=3. time=1. ms > ... > Does it mean a multicast packet has passed the firewall? > Sorry for my very newbie question. Dunno if that's what you are looking for. Who is 192.168.2.254? What I can say is that (assuming your firewall software is working at all) you are allowing ICMP echo request (ping) packets with a source address of the firewall and a destination of 224.0.0.1 out of the firewall, and allowing ICMP echo responses (pong) packets into the firewall itself with a source of 192.168.2.254. So, yes, you do seem to be allowing multicast packets out of the firewall, but this says nothing about the ability of the firewall to receive and forward multicast. But your quote pretty much says it all. As far as the FW-1 software is concerned, multicast addresses are no different than unicast... or broadcast for that matter; they are all just 32-bit numbers. -- Crist J. Clark [email protected] Globalstar CommunicationsThe information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact [email protected] ================================================= To set vacation, Out Of Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
|