NETWORK PRESENCE ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT
 


Search
display results
words begin  exact words  any words part 

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [FW-1] How to make a multicast packet to test it passingthroughFW-1?



Guangcheng Wen wrote:
>
> Hello,
> Thanks a lot for your great help.
>
> crist.clark> You'd have to set up multicast routing on the firewall to do that. That's
> crist.clark> a lot more complicated than just making a multicast packet.
>
> I have no idea howto set up multicast routing on a firewall.
> The firewall manual said,
> "Firewall 1 does not treat multicast as a special case, so for VPN-1/FireWall-1
> , a multicast packet is simply an IP packet with a class D (224.0.0.0   239.255
> .255.255) destination address."
>
> crist.clark> If you want to make a multicast packet, on a default install of Solaris
> crist.clark> you can just,
> crist.clark>
> crist.clark>   $ ping -I1 224.0.0.1
> crist.clark>
> crist.clark> For real fun (if you have other Solaris systems on the LAN with the default
> crist.clark> multicasting setup). A "ping 224.0.0.1" will also work fine on a Windows
> crist.clark> box (Win2k anyway).
>
> I have just $ ping -I1 224.0.0.1 in the firewall(Solaris8) and got
> the following message,
> PING 224.0.0.1: 56 data bytes
> 64 bytes from fwlb2 (192.168.2.254): icmp_seq=0. time=3. ms
> 64 bytes from fwlb2 (192.168.2.254): icmp_seq=1. time=1. ms
> 64 bytes from fwlb2 (192.168.2.254): icmp_seq=2. time=0. ms
> 64 bytes from fwlb2 (192.168.2.254): icmp_seq=3. time=1. ms
> ...
> Does it mean a multicast packet has passed the firewall?
> Sorry for my very newbie question.

Dunno if that's what you are looking for. Who is 192.168.2.254? What I can
say is that (assuming your firewall software is working at all) you are
allowing ICMP echo request (ping) packets with a source address of the
firewall and a destination of 224.0.0.1 out of the firewall, and allowing
ICMP echo responses (pong) packets into the firewall itself with a source
of 192.168.2.254.

So, yes, you do seem to be allowing multicast packets out of the firewall,
but this says nothing about the ability of the firewall to receive and
forward multicast. But your quote pretty much says it all. As far as the
FW-1 software is concerned, multicast addresses are no different than
unicast... or broadcast for that matter; they are all just 32-bit numbers.
--
Crist J. Clark                               [email protected]
Globalstar CommunicationsThe information contained in this e-mail message is confidential,
intended only for the use of the individual or entity named above.
If the reader of this e-mail is not the intended recipient, or the
employee or agent responsible to deliver it to the intended recipient,
you are hereby notified that any review, dissemination, distribution or
copying of this communication is strictly prohibited.  If you have
received this e-mail in error, please contact [email protected]

=================================================
To set vacation, Out Of Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================



 
----------------------------------

ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT SITE MAP LEGAL
   All contents © 2004 Network Presence, LLC. All rights reserved.