Re: Checkpoint FW-1 and linux Freeswan VPN problem

I have check rules on both sides, all is ok but when i tried to ping the

>public ip address of the linux freeswan it seems that checkpoint is trying >to build a vpn to reach this >public IP address so the ping are lost... >

Have you checked your Implicit Rules for the enforcement module? By default Checkpoint disables ICMP traffic through the firewall and must be enabled.


Reply to
Dave Gresham
Loading thread data ...

Reply to
Brian Chase

Well apparently it is not that, first because the remote network can reach our network and because i have set a rule that permit local hosts to send icmp request.

I just don't see why the checkpoint try to rebuild a second vpn when i try to ping the remote firewall public address, is it something to see why this public address is routed through the vpn and not through the internet interface ?

Thanx for your help


"Dave Gresham" a écrit dans le message de news:4060550c$0$172$

Reply to

The simplest explanation is that CP does as its policy database states, i.e. all traffic to the public address goes through a VPN. Since ICMP doesn't match any existing SA for TCP or UDP, CP tries to create a new one.

Check once more the rule base. I'm not familiar with the details of CP user interface, but if the rule to VPN all packets comes before a rule that passes ICMP, the former rule probably overrules the latter...

-- Lassi

Reply to
Lassi Hippeläinen Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.