NETWORK PRESENCE ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT
 


Search
display results
words begin  exact words  any words part 

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [FW-1] Traffic between subnets - problem


  • To: [email protected]
  • Subject: Re: [FW-1] Traffic between subnets - problem
  • From: "Laidlaw, Rob" <[email protected]>
  • Date: Thu, 3 Jul 2003 16:40:41 -0500
  • Reply-to: Mailing list for discussion of Firewall-1 <[email protected]>
  • Sender: Mailing list for discussion of Firewall-1 <[email protected]>
  • Thread-index: AcNBqytSWQAJReGBQNeF7SdZJA7LBgAAEVlg
  • Thread-topic: [FW-1] Traffic between subnets - problem

You need to create two rules.  The first being the rule you have saying that dmz -> known should remain unchanged.  Below that rule, put another rule saying that dmz -> any nat to whatever.

-----Original Message-----
From: Jonathan Nichols [mailto:[email protected]]
Sent: Thursday, July 03, 2003 4:26 PM
To: [email protected]
Subject: Re: [FW-1] Traffic between subnets - problem


> You need to use specific NAT rules. If you use the NAT option on the Object
> you get NAT
> on regardless of the destination, Internet or DMZ, like is your problem.
>
> To solve this:
> 1 -  Remove the NAT configuration on the objects from the internal network.
> 2 - Add a NAT rule from the internal network to the Internet on the NAT
> rule base.
> That way the traffic from the internal network to the dmz will not be
> Nated.
> To qualify the Internet on a Nat Rule use a group called Known, where you
> put all your internal
> and DMZ networks. Negate this group on the Nat rule on the destination
> field.
>

Great, thanks!
I'm only having a small problem now..
On the Address Translation screen, under all the automatically generated
rules, I tried several things such as:

Source
DMZ -> Known (Group with INT and DMZ) -> Any

Destination
Original -> Original -> Original

I tried to negate the "Known" group, but "Negate" wasn't an option.
I also have INT-range and DMZ-range.. am I editing the wrong objects?
I think I vaguely understand this a bit more now.. I can get one or the
other working, not both. :)

Thanks for your help!
-Jonathan

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================
Disclaimer - 07/03/2003
This information in this email is confidential and may be legally privileged. It is intended solely for Mailing list for discussion of Firewall-1.  Access to this Internet email by anyone else is unauthorized.

EnvestnetPMC, Inc. does not accept time-sensitive transactional messages, including orders to buy and sell securities, account allocation instructions, or any other instructions affecting a client account, via e-mail.

If you are not the intended recipient of this email, any disclosure, copying, or distribution of it is prohibited and may be unlawful.  If you have received this email in error, please notify the sender and immediately and permanently delete it and destroy any copies of it that were printed out.  When addressed to our clients, any opinions or advice contained in this email is subject to the terms and conditions expressed in any applicable governing EnvestnetPMC terms of business or agreements.

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================



 
----------------------------------

ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT SITE MAP LEGAL
   All contents © 2004 Network Presence, LLC. All rights reserved.