| |
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [FW1] Nat Confusion
On Wed, Oct 11, 2000 at 07:42:33PM -0500, Rodrick Brown wrote:
:
:
: Sorry, but im still lost
:
: here is my setup
:
: [Internet]
: |
: [CheckPoint -Solairs FireWall Box]
: | |
: [WebServer 192.168.0.2] [DB Server 192.168.0.3]
: |_____________________________|
: 10.X.1 10.X.2
Simple.
Make two network objects:
web-ext: 206.65.184.34
web-int: 192.168.0.2
Make sure your "valid addresses" for the internal i/f of your fw
permit web-ext to show up on the internal i/f. Why? NAT happens
AFTER routing, but BEFORE transmission.
Security Policy Rules:
Any web-ext http Accept (whatever kind of logtype)
NAT Rules:
web-int Any Any web-ext(static) =Original =Original
Any web-ext Any =Original web-int(static) =Original
Static route on your firewall:
206.65.184.34/32 -> 192.168.0.2
ARP published on your external LAN:
206.65.184.34 == 08:20:d0:e8:68
(assuming this is the MAC address of your fw's external i/f)
: I dont understand how checkpoint would know to respond to that
: ip if its not binded locally to it on one of its interface please
: show me the light =( as you can see im totally lost.
That's what the arp is for. The arp published on the external LAN will
cause the traffic to be directed at the firewall. Once the firewall
gets it, routing/fw1 take over.
--
Jason Costomiris <>< | Technologist, geek, human.
jcostom {at} jasons {dot} org | http://www.jasons.org/
Quidquid latine dictum sit, altum viditur.
================================================================================
To unsubscribe from this mailing list, please see the instructions at
http://www.checkpoint.com/services/mailing.html
================================================================================
|
|
