[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [FW-1] Traffic between subnets - problem
You need to create two rules. The first being the rule you have saying that dmz -> known should remain unchanged. Below that rule, put another rule saying that dmz -> any nat to whatever. -----Original Message----- From: Jonathan Nichols [mailto:[email protected]] Sent: Thursday, July 03, 2003 4:26 PM To: [email protected] Subject: Re: [FW-1] Traffic between subnets - problem > You need to use specific NAT rules. If you use the NAT option on the Object > you get NAT > on regardless of the destination, Internet or DMZ, like is your problem. > > To solve this: > 1 - Remove the NAT configuration on the objects from the internal network. > 2 - Add a NAT rule from the internal network to the Internet on the NAT > rule base. > That way the traffic from the internal network to the dmz will not be > Nated. > To qualify the Internet on a Nat Rule use a group called Known, where you > put all your internal > and DMZ networks. Negate this group on the Nat rule on the destination > field. > Great, thanks! I'm only having a small problem now.. On the Address Translation screen, under all the automatically generated rules, I tried several things such as: Source DMZ -> Known (Group with INT and DMZ) -> Any Destination Original -> Original -> Original I tried to negate the "Known" group, but "Negate" wasn't an option. I also have INT-range and DMZ-range.. am I editing the wrong objects? I think I vaguely understand this a bit more now.. I can get one or the other working, not both. :) Thanks for your help! -Jonathan ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] ================================================= Disclaimer - 07/03/2003 This information in this email is confidential and may be legally privileged. It is intended solely for Mailing list for discussion of Firewall-1. Access to this Internet email by anyone else is unauthorized. EnvestnetPMC, Inc. does not accept time-sensitive transactional messages, including orders to buy and sell securities, account allocation instructions, or any other instructions affecting a client account, via e-mail. If you are not the intended recipient of this email, any disclosure, copying, or distribution of it is prohibited and may be unlawful. If you have received this email in error, please notify the sender and immediately and permanently delete it and destroy any copies of it that were printed out. When addressed to our clients, any opinions or advice contained in this email is subject to the terms and conditions expressed in any applicable governing EnvestnetPMC terms of business or agreements. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
|