[FW1] ICMP Transit Error

[Thuan Pham <tpham@FW1-NOSPAMipverse.com>]

Title: ICMP Transit Error

        Hello All:

        I have an Extranet CheckPoint Firewall-1 that connects to a Cisco AS5300 pointing to external networks.  On the CheckPoint Firewall-1 server, there are three interfaces: hme0 (connected to internal networks), hme1 (connected to the DMZ zone), and hme2 (pointing to the AS5300 which connects to external networks).  There is no NAT running.  Here are the problems that I encounter:

1.  When I telnet to the DMZ workstation coming off from the hme1 interface of the Firewall-1 server, I am able to login in.  However, my internal address is being NAT to a valid public routable IP address which has been set up on the Internet Firewall-1 that I currently have.

2.  When I am in the DMZ workstation and try to ping a host on the other side of the external interface of the Firewall-1, I get the error message:

        ICMP Time exceeded in transit from <DMZ Interface IP Address on the CheckPoint Firewall Server>
        for icmp from SJ-TAC01 <DMZ Workstation IP Address> to daem01 <External Host IP Address>

I have tried to change a few things but I have not been able to fix the problems.  I would appreciate any comments that will be provided.

Thanks,

Thuan Pham