| |
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[FW-1] SecuRemote IP Pool NAT on the same subnet NG FP2 WIN2K
Hi all,
>From Check Point's knowledgebase, IP Pool NAT on the
same subnet as one of the firewall's interfaces cannot
be done unless we implement a method using proxy arp.
The firewall's internal interface has the following
network parameters:
IP: 192.168.1.1
Mask: 255.255.255.0
I tried using proxy arp by doing the following:
1. Created a "smaller" subnet of the current "bigger"
subnet in the firewall policy as a Network object
called "smaller_net".
eg. "Bigger" subnet: 192.168.1.0 (255.255.255.0)
"Smaller" subnet: 192.168.1.128 (255.255.255.128)
2. Created a local.arp file in $FWDIR\state with all
the IP Pool NAT addresses to match the firewall's
internal MAC address:
eg.
192.168.1.129 00-50-56-C0-00-09
192.168.1.130 00-50-56-C0-00-09
.
.
192.168.1.254 00-50-56-C0-00-09
3. Removed Automatic ARP configuration from the Global
Properties Settings since Secureknowledge highlighted
that Automatic Arp does not support proxy arp.
4. Configured IP Pool NAT to use the "smaller_net"
network object defined in No.1 as well as other
necessary SecuRemote configurations.
5. Installed the policy and rebooted the firewall
After that I tested the SecuRemote connections again.
>From the VPN logs, I could see that the VPN connection
succeeded, and I was assigned an IP Pool NAT address
of 192.168.1.129; however, I could not ping any
servers in the 192.168.1.0/24 network. I used a
sniffer to check the packets and saw that nobody is
responding ARP requests for 192.168.1.129. This means
that the firewall STILL does not know how to respond
to ARP requests to the IP Pool NAT addresses even when
proxy arp has been set. I ran the "fw ctl arp" command
and the message "No Proxy Arp addresses" were
displayed.
Did I configure the proxy arp wrongly?
Thanks in advance.
Cheerios,
Vic
__________________________________________________
Do You Yahoo!?
Yahoo! Finance - Get real-time stock quotes
http://finance.yahoo.com
=================================================
To set vacation, Out Of Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================
|
|
