firewall-1 NG NAt/local.arp/arp question

From: news-west.newscene.com (lynxo78@nospamhere.hotmail.com)
Date: 09/04/02 

From: "news-west.newscene.com" <lynxo78@nospamhere.hotmail.com>
Date: 4 Sep 2002 03:34:35 -0500

Hi,

Im studying for my checkpoint firewall NG exam, I have setup a test
environment with 3 pcs, 1 pc each on a different subnet and one as the
router. This is the environment:

subnet 1 (simulated internet): 192.168.253.0/24

subnet 2: 10.1.1.0/24

pc1 (subnet 1) -

192.168.253.101/24

pc2 (subnet 2) -

10.1.1.2/24

router (running NT4 server sp6a with ip forwarding enabled)

subnet 1 address: 192.168.253.125/24
subnet 2 address: 10.1.1.1/24

I have installed NG with FP2. It seems to be working fine and I have managed
to get NAT working but im not sure I have done it correctly. I have been
reading some documentation about adding a static NAT public to private
address rule. It mentions that you need to add an object with a routable
address. In this case, as a test I want to use 192.168.253.126.

My policy rules allow everything. My NAT rules read like this, only relevant
info shown..

1. (source) 10.1.1.2 ( dest) any (service) any / (source) 192.168.253.126
(dest) original (service) any
2. (source) any (dest) 192.168.253.126 (service) any / (source) any (dest)
10.1.1.2 (service) any

Now this should allow traffic out from 10.1.1.2 to 192.168.253.x at least...
it doesn't. I'm assuming that this is because 192.168.253.126 is not really
bound to anything, so the packet doesn't know where to go??

To get it working I edited the object 192.168.253.126 and changed it to be
automatic static NAT with an address of 192.168.253.126. This added a rule
above the existing one. Outgoing traffic now works. Is what I have done
correct?

To get inbound services working I created a local.arp file (which wasn't
there) in the conf directory. Restarted NG, works fine. I was curious as to
why you can't use the NT arp command to add a static entry (at least thats
what the docs say). I added a static entry and deleted local.arp and
restarted etc.. it still works?? I cleared out arp caches first etc.. Why do
they say you can't do this?

Thanks for any help or advice.

James

Relevant Pages

  • firewall-1 NG NAt/local.arp/arp question
    ... environment with 3 pcs, 1 pc each on a different subnet and one as the ... automatic static NAT with an address of 192.168.253.126. ... why you can't use the NT arp command to add a static entry (at least thats ...
    (comp.security.firewalls)
  • Creating a Single-IP Site for Disaster Recovery
    ... slower frequency than the rest of the DC's, ... the environment, ... want this server to push any of its data, ... Also, this DR DC would be on the same subnet as other servers, and the ...
    (microsoft.public.windows.server.active_directory)
  • Error in OSDInstallWizard
    ... <![LOG[Local user may specify image ... <![LOG[No AD site set in the environment. ... <![LOG[Comparing DP subnet 10.103.22.0 to local machine subnet ... <![LOG[The operating system installation failed. ...
    (microsoft.public.sms.tools)
  • Migrating AD (Windows Server 2003) from one Subnet to Another
    ... I have an existing Windows Server 2003 Active Directory environment, ... network with the IP address configuration 10.0.200.0/24 and this subnet is ... defined within the AD and both of the servers have IP addresses within this ... I now need to migrate this environment from the 10.0.200.0/24 network to the ...
    (microsoft.public.windows.server.networking)
  • Migrating IP Subnets in AD (Windows Server 2003)
    ... I have an existing Windows Server 2003 Active Directory environment, ... network with the IP address configuration 10.0.200.0/24 and this subnet is ... defined within the AD and both of the servers have IP addresses within this ... I now need to migrate this environment from the 10.0.200.0/24 network to the ...
    (microsoft.public.windows.server.active_directory)