December 4, 2008 10:34pm pst

1. grimkin 50,734
2. larstr 16,400
3. mabutterfi... 12,250
4. stagira 9,250
5. Chris-Dent 5,300
6. srikrishnak 4,272
7. RobWill 4,000
8. robocat 3,500
8. mkielar 3,500
10. donjohnston 2,750
11. Dooglave 2,500
11. Paranorm... 2,500
11. dpk_wal 2,500
14. Walkabou... 2,000
14. wtstadd 2,000
14. tfowles 2,000
14. bmadison23 2,000
14. MrJemson 2,000
14. fileinster 2,000
14. paulh36 2,000
14. pkutter 2,000
14. BradGroux 2,000
14. rpalmeira22 2,000
14. billwharton 2,000
25. leew 1,600
25. nagehmai 1,600

1. Dooglave 63,306
2. grimkin 60,297
3. tim_holman 40,230
4. srikrishnak 30,861
5. lrmoore 27,762
6. dbardbar 26,704
7. larstr 17,000
8. mabutterfi... 12,250
9. charan_j... 10,643
10. stagira 9,250
11. nstand 7,500
12. parbul 7,336
13. dschwart... 6,940
14. richrumble 6,840
15. RobWill 6,750
16. imreble1 6,596
17. keith_ala... 6,332
18. bloemkool... 6,300
19. robocat 5,500
20. yokel 5,452
21. Chris-Dent 5,300
22. tmehmet 5,000
23. beloved101 4,622
24. Nemesis... 4,550
25. chris_cal... 4,430

09.03.2008 at 09:23AM PDT, ID: 23699820

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

8.9

Checkpoint - Firewall preventing ip range from routing internally.

Asked by jmjstevens in Networking Hardware Firewalls, Checkpoint Firewall, TCP/IP

Tags: Checkpoint, Firewall, NG R54, running on a Windows 2000 Server

We are having a problem with our CheckPoint (NG R54) firewall running on a Windows 2000 Server with a seperate network we're trying to add.

The CheckPoint internal interface is 10.0.0.1. Subnet is /8. We're adding a router internal to that network with external interface 10.0.0.253, internally is 172.27.0.1, subnet /16.

It looks like this:

Gateway router with routable IPs --> CheckPoint external interface with routable IP -->Checkpoint internal interface with IP 10.0.0.1 ---> 10.0.0.0/8 network --> internal router outside interface with IP 10.0.0.253 --> internal router inside interface with IP 172.27.0.1 --> 172.27.0.0/16 network

Hosts on the data network, 10.0.0.0/8, are configured with a default gateway of the internal interface of the firewall, 10.0.0.1. Hosts on the 172.27.0.0 network are configured with the gateway of 172.27.0.1.

The inside router is not running any nat, any dhcp, firewall, etc. It just has IP addresses and a default route pointing to 10.0.0.1.

We're having difficulty getting traffic between the 10.0.0.0/8 network and the 172.27.0.0/16 network, in either direction.

If we put a persistent route on server on the network of: route add 172.27.0.0 mask 255.255.0.0 10.0.0.253 -p, we can ping between the server in question and the 172 network. We tried adding this route to the CheckPoint firewall. Before we added the route, it was trying to send the 172.27.0.0 traffic to the outside interface and to the gateway router. Since we added the route, the traffic just hits the firewall and dies. We can ping the internal router's outside interface at 10.0.0.253 from the firewall, but cannot ping the inside interface of 172.27.0.1. We can see traffic leave the 172.27.0.0/16 network from the inside router, but the packets are never sent back from 10.0.0.1.

Our conclusion is that the firewall (10.0.0.1/8) is not properly routing traffic destined for the 172.27.0.0/16 network properly. Rather, it is dropping the traffic at the firewall. The first firewall rules permit the 172.27.0.0/16 network to any, and the second permits any to 172.27.0.0/16. So the firewall RULES shouldn't be prohibiting anything.

Here is a printout of the routing tables from the CheckPoint firewall:

C:\Documents and Settings\Administrator>route print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x1000003 ...00 0b db 93 79 ef ...... b57w2k5 Broadcom NetXtreme Gigabit Etherne
t Driver
0x1000004 ...00 0b db 93 79 f0 ...... b57w2k6 Broadcom NetXtreme Gigabit Etherne
t Driver
0x1000005 ...00 04 23 82 45 52 ...... E10007 Intel(R) PRO/1000 MT Dual Port Netw
ork Connection
0x1000006 ...00 04 23 82 45 53 ...... E10008 Intel(R) PRO/1000 MT Dual Port Netw
ork Connection
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 208.224.173.254 208.224.173.253 1
10.0.0.0 255.0.0.0 10.0.0.1 10.0.0.1 1
10.0.0.1 255.255.255.255 127.0.0.1 127.0.0.1 1
10.255.255.255 255.255.255.255 10.0.0.1 10.0.0.1 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
172.27.0.0 255.255.0.0 10.0.0.253 10.0.0.1 1
208.224.173.3 255.255.255.255 10.0.0.3 10.0.0.1 1
208.224.173.128 255.255.255.192 208.224.173.129 208.224.173.129 1
208.224.173.129 255.255.255.255 127.0.0.1 127.0.0.1 1
208.224.173.224 255.255.255.224 208.224.173.253 208.224.173.253 1
208.224.173.253 255.255.255.255 127.0.0.1 127.0.0.1 1
208.224.173.255 255.255.255.255 208.224.173.129 208.224.173.129 1
208.224.173.255 255.255.255.255 208.224.173.253 208.224.173.253 1
224.0.0.0 224.0.0.0 10.0.0.1 10.0.0.1 1
224.0.0.0 224.0.0.0 208.224.173.129 208.224.173.129 1
224.0.0.0 224.0.0.0 208.224.173.253 208.224.173.253 1
255.255.255.255 255.255.255.255 10.0.0.1 10.0.0.1 1
Default Gateway: 208.224.173.254
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
208.224.173.3 255.255.255.255 10.0.0.3 1
172.27.0.0 255.255.0.0 10.0.0.253 1

C:\Documents and Settings\Administrator>

Here is a printout of the routing table from the new router (Cisco 1811)

C      172.27.0.0/16 is directly connected, FastEthernet1
C      10.0.0.0/8 is directly connected, FastEthernet0
S*      0.0.0.0/0 [1/0] via 10.0.0.1

What could be preventing the firewall from routing the 172.27.0.0/16 network back to 10.0.0.253?

Start Free Trial

Keywords: Checkpoint - Firewall preventing ip ra…

	Title
1	Checkpoint R55 cannot access internet
2	Issue with NAT on Checkpoint NG fire…
3	Checkpoint NAT and WAN configuration
4	Good Firewal Software
5	setting netmask
6	Need to install trial CheckPoint Firewall…

Loading Advertisement...

20081112-EE-VQP-42 / EE_QW_2_20070628

Checkpoint - Firewall preventing ip range from routing internally.

Asked by jmjstevens in Networking Hardware Firewalls, Checkpoint Firewall, TCP/IP

Tags: Checkpoint, Firewall, NG R54, running on a Windows 2000 Server

About this solution