[FW-1] Strange SNMP with Logical Interfaces

[Crist Clark <crist.clark@FW1-NOSPAMGLOBALSTAR.COM>]

Having problems with a badly behaving SNMP daemon on a Checkpoint firewall.

One physical interface of the firewall say, qfe0, has three addresses,

  qfe0   -  10.10.1.1/24
  qfe0:1 -  10.10.2.1/24
  qfe0:2 -  10.10.3.1/24

There is a host, 10.10.2.10, that tries to do an SNMP read to the "closest"
address (its default route),

  10.10.2.10:64001 -> 10.10.2.1:161

But no response comes back. The SNMP daemon on the firewall reports
no errors. The firewall logs the incoming packet as accepted, there
being a rule to allow this host to query it. Nothing is logged as
being dropped leaving the firewall.

I should note that the SNMP daemon is NOT well behaved. It will respond
to a query using the "nearest" interface to the sender. That is, no
matter what address an SNMP packet is sent to, the source on the response
is the IP of the interface the packet goes out on. It should not matter
in the above case since the two are one in the same.

However, when the host 10.10.2.10 tries to query 10.10.3.1, it DOES work,

  10.10.2.10:64002 -> 10.10.3.1:161
  10.10.2.1:161 -> 10.10.2.10:64002

Note the source address on the response. This works because we know about
the issue and have a rule that allows UDP with ephemeral port destinations
and 161 source out of the firewall to the hosts allowed to do SNMP gets.
The stateful treatment of UDP by the firewall should not be getting in
the way.

So, a query to 10.10.2.1 doesn't work. A query to 10.10.3.1 does work.
And for completeness, 10.10.1.1 does NOT work either.

To verify that it's not something weird inside of the SNMP daemon,
I can do SNMP gets to all three addresses on the firewall itself. So
things work fine over the loopback. Only when they cross the network...
and the firewall software, do we have problems.

Anyone have any ideas what to do here? Nothing is dropped in the logs
and the results seem inconsistent.
--
Crist J. Clark                               crist.clark@globalstar.com
Globalstar CommunicationsThe information contained in this e-mail message is confidential,
intended only for the use of the individual or entity named above.
If the reader of this e-mail is not the intended recipient, or the
employee or agent responsible to deliver it to the intended recipient,
you are hereby notified that any review, dissemination, distribution or
copying of this communication is strictly prohibited.  If you have
received this e-mail in error, please contact postmaster@globalstar.com

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to LISTSERV@amadeus.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================