RE: [FW1] (Still having) NAT Problem

["Michael Knost" <michael@FW1-NOSPAMknost.com>]

What version of FW are you using?  What OS are you running it on.  There
is a bug with Static NAT running NG on Win2K.
 

	-----Original Message----- 
	From: Satana 
	Sent: Wed 10/3/2001 12:08 PM 
	To: Chris Arnold; 'Brockhoven, Werner ';
fw-1-mailinglist@beethoven.us.checkpoint.com 
	Cc: 
	Subject: [FW1] (Still having) NAT Problem
	
	


	Hi everybody and thanx for all your answers....
	I've checked my FW1 rules & Address Translations and...you got
me! something
	was messed up.
	Anyway..... I forgot to say that I obviously did the ARPing (arp
-s EXT_IP
	MAC_ADDR pub) and I added the route (route add EXT_IP INT_IP 1),
but still
	it isn't working. I've got an error on FW1 logs regarding rule0
(?). I'm
	pretty out of any ideas...
	Thanx again for help and interest
	
	Lorenzo
	
	
	
	
	----- Original Message -----
	From: "Chris Arnold" <chris.arnold@WheelHouse.com>
	To: "'Brockhoven, Werner '" <Werner.Brockhoven@Compaq.com>;
"''Satana' '"
	<satana@libero.it>;
<fw-1-mailinglist@beethoven.us.checkpoint.com>
	Sent: Thursday, September 27, 2001 5:19 PM
	Subject: RE: [FW1] NAT Problem
	
	
	>
	> I would stay away from automatic NAT rules personally.  Do it
manually as
	> there used to be issues with automatic NAT rules and manually
gives you a
	> finer level of control as well.
	>
	> Chris
	>
	> -----Original Message-----
	> From: Brockhoven, Werner
	> To: 'Satana'; fw-1-mailinglist@beethoven.us.checkpoint.com
	> Sent: 9/26/01 2:13 AM
	> Subject: RE: [FW1] NAT Problem
	>
	> Hello Lorenzo,
	>
	> So you are trying to configure static destination nat.
	>
	> It may be easier to let FW-1 configure the nat rule by
configuring the
	> NAT tab in the workstation object which represents the
internal machine.
	> Because you are using static destination nat you'll have to
configure a
	> route on the firewall for the external ip adress and have it
point to
	> the internal ip adress of the www server.  In your firewall
object
	> you'll have to configure antispoofing on the internal
interface and add
	> the external ip adress of the www server.  Finally you'll want
to
	> publish the external ip adress on your gateway via arp so the
external
	> router knows where to send the packets.
	>
	> Regards,
	>
	> Werner
	>
	>
	>
	> -----Original Message-----
	> From: Satana [ mailto:satana@libero.it]
	> Sent: Tuesday, September 25, 2001 10:51 AM
	> To: fw-1-mailinglist@beethoven.us.checkpoint.com
	> Subject: [FW1] NAT Problem
	>
	>
	> Hi everybody
	> I've got tihs problem: I have to publish over www an internal
machine
	> (which obviously has an internal IP adress) and I have to make
FW1 nat
	> its ip to the external ip adress (that is already routed on
the right
	> router & CDN).
	> I've made a rule within the "Adress Translation" which says as
original
	> packet :
	> SOURCE : Internal IP
	> DESTINATION : Any
	> SERVICE : Any
	> as translated packet:
	> SOURCE : External IP
	> DESTINATION : Original
	> Service : Original
	> And it's obviously installed on FW1 cluster.
	> There's also a rule in security policy:
	> SOURCE : Any
	> DESTINATION : External IP
	> SERVICE : http
	> ACTION : Accept
	> What I have to do now ? To me it seems all fine, but it
doesn't work.
	> Where I'm doing it wrong ?
	> Thanks in advance
	>
	> Lorenzo
	>
	>
	>
	>
	
========================================================================
====
	====
	>      To unsubscribe from this mailing list, please see the
instructions at
	>                http://www.checkpoint.com/services/mailing.html
	>
	
========================================================================
====
	====
	>
	
	
	
	
========================================================================
========
	     To unsubscribe from this mailing list, please see the
instructions at
	               http://www.checkpoint.com/services/mailing.html
	
========================================================================
========

<<winmail.dat>>