1. Home
  2. Networking Firewalls
  3. Checkpoint Static Route

Checkpoint Static Route

Greetings, I am trying to setup a static route on a Checkpoint firewall NG R55.

Scenario: Internal LAN 172.16.0.0/21 fw (def gateway) 172.16.2.1 rtr to new off 172.16.7.254

rtr AT new off 172.18.7.254 new office LAN 172.18.0.0/21

I have added the static route in the Nokia Voyager of the firewall.

within Checkpoint I have: created a network 172.18.0.0/21 created a rule to allow all traffic bi-directional between

172.16.0.0/21 and 172.18.0.0/21

At a workstation on the 172.16 LAN I try to ping 172.18.7.254 (router on the 172.18 LAN)

The packets are dropped by the firewall with a message in the FW log "Address Spoofing"

If I set the static route on the local workstation everything is fine as it bypasses the firewall.

Any ideas as to what else I need to do?

Thanks much!

-fitz

Reply to
bfitzwater
Loading thread data ...

As your description, I assume your topology is like the draw below

172.16.0.0 172.18.0.0 WAN -- Firewall --------------- router ----------- New Office

The rule for traffic between 172.16.0.0 / 21 and 172.18.0.0 is not necessary and you can delete it. You got the "Address Spoofing" becase you didn't let Checkpoint know how many subnets are behind firewall. Create a network group and add 172.16.0.0/21 and 172.18.0.0/21 to that group. At the properties of internal interface, define that network group as a specific interface behind that interface. Good Luck

Reply to
Dophi

Dophi, Thanks very much for the tip. Tried that and it did not help. Any other ideas to my dilemma are most welcome.

-fitz

Reply to
bfitzwater

If there is only one default gateway of your clients in 172.16.0.0/21 and no other routes in clients. The data flow of ICMP of client A in 172.16.0.0/21 to client B in

172.18.0.0/21 should be "client A --> firewall --> router --> client B". Then, the data flow of client B response ICMP should be "client B -->

router --> client A"

So, you need two more steps as below

  1. Add a rull to accept a bi-directional traffic between 172.16.0.0/21 and 172.18.0.0/21.
  2. At the Stateful Inspection of Global Properties, uncheck "Drop out of state TCP, UDP, ICMP packets"

I hope this can help you. : )

Reply to
Dophi

Dophi, Thanks very much, did all that and no joy. I can almost feel the packets trying so hard to go where I want them to go despite my lack of knowledge. I think the best thing for me is to just change the default gateway for all the workstations and servers to the Router. Then let the router handle things from there. I'm starting to do that now and it is working fine...just have to configure the default gateway on 56 servers and try not to break anything in the process. thanks again.

-fitz

Reply to
bfitzwater

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.