RE: [fw-wiz] Remote Access via Checkpoint VPN

From: Orca (klrorca_at_hotmail.com)
Date: 08/21/04

  • Next message: Orca: "RE: [fw-wiz] NAPT - NAT Port selection" 
    To: <firewall-wizards@honor.icsalabs.com>
Date: Fri, 20 Aug 2004 16:48:11 -0700

    That is a bit harsh,

    You can put a 10.X space towards the internet, it just won't do any good, as
    nobody will route RFC1918 spaces.

    That being said judging from his notes there a router providing NAT on the
    "internet" side of his fire wall, correct? If so you also need to set your
    NAT static routes to allow the VPN through, which should be something like
    TCP port 50 for IPSEC UDP port 500 of IKE and TCP 264 for Checkpoint
    topology download. There might be more, I have not used a checkpoint for a
    while, check the docs.

    You will also have to do this for the firewall itself, to let it get to the
    DMZ.

    The versions of checkpoint I used (again old) would not bind by any port but
    the External, but they might have changed that. You can do this with a Cisco
    box though.

    -Steve

    -----Original Message-----
    From: firewall-wizards-admin@honor.icsalabs.com
    [mailto:firewall-wizards-admin@honor.icsalabs.com] On Behalf Of Desai,
    Ashish
    Sent: Wednesday, August 18, 2004 7:57 AM
    To: Ludolph, Michel; firewall-wizards@honor.icsalabs.com
    Subject: RE: [fw-wiz] Remote Access via Checkpoint VPN

    You might want to read this BEFORE you try anything this X!@#$!#$

    http://www.faqs.org/faqs/cisco-networking-faq/section-24.html

    You CANNOT expose 10.x address space to the Internet!!!!!

    Ashish

    -----Original Message-----
    From: Ludolph, Michel [mailto:Michel.Ludolph@atosorigin.com]
    Sent: Tuesday, August 17, 2004 4:52 AM
    To: firewall-wizards@honor.icsalabs.com
    Subject: [fw-wiz] Remote Access via Checkpoint VPN

    Hello,

    I have the following setup up with Checkpoint FW-1:

    Internet------10.x.x.x--FW--10.x.x.x----- Internal network
                                    |
                                    |
                                    |
                            20.20.20.20 (DMZ)

    Pease note:
    - the external FW-interface has a private IP-address (10.x.x.x).
    - the DMZ FW-interface has a public IP-address (20.20.20.20 as an
    example)

    I would like to setup a VPN on the FW, to which a remote client can
    connect via the Internet, using SecureClient. According to Checkpoint
    documentation the VPN should bind to the FW-external interface. This is
    the problem, my FW-external interface has a private IP-address, which is
    not routable via the Internet. In order to make this working I would
    like the VPN to bind to the DMZ-interface (20.20.20.20) instead of the
    external interface.

    Has anyone setup such a VPN and does it work or do you have any
    suggestions?

    Thanks for your help.

    michelDOTludolphATatosoriginDOTcom
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Orca: "RE: [fw-wiz] NAPT - NAT Port selection"

    Relevant Pages

    • Re: Using a Linksys router, should I also use Zonealarm? Internet Acceptable Use Policy
      ... depending on your VPN client when you connect to VPN server client will ... As soon as you connect to VPN server that will be default route. ... other network address. ... I created new default route for my internet traffic that points to my ISP. ...
      (microsoft.public.security)
    • Re: Two Internet Gateways
      ... local internet connection and the route for your headquarter to be the VPN. ... As far as adding a Cisco VPN client I don't know what that guy was thinking. ...
      (microsoft.public.windowsxp.general)
    • Re: Connecting via remote
      ... I believe you could setup VPN server on this high speed internet ... Let say this VPN/Router server in branch office would have IP 10.10.10.10 ... In order to have routes there must be segments to route ...
      (microsoft.public.windows.server.networking)
    • Re: Remote Access
      ... You can only have one default route ... Have a dedicated server for Remote access. ... >I tried setting up a VPN and I must have done something ... >the users in the office no longer had internet access. ...
      (microsoft.public.win2000.ras_routing)
    • Re: VPN Client Internet Browsing Traffic Sent Thru RAS?
      ... By default, the client sets up a default route to the RRAS server, so ... that all traffic goes over the VPN link. ... This leaves the default route set to the Internet connection and sets a ...
      (microsoft.public.win2000.ras_routing)