topic Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5 in Firewall and Security Management

R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

IWishIKnewMore — Thu, 27 Jan 2022 03:14:56 GMT

I have a 3100 updated to R81.10.

Right now I'm upgrading from an older 600, but noticing Gaia is less friendly to the novice - so bare with the stupid questions.
On my 600 there was literally a WAN/DHCP mode you could turn on for an interface - the 3100 doesn't seem to have this.

What setting/configurations to I need get going to I can achieve the same functionality.
I can't seem to find any guides to this end - I'm guessing this is so basic as to be laughable to have a guide.

Any help appreciated.

Thanks!

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

Chris_Atkinson — Thu, 27 Jan 2022 16:18:18 GMT

Please refer to sk92768 for instructions for the WebUI / CLISH.

But in case you meant using the Gateway itself as a DHCP server this is also possible refer:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/DHCP-Server-Gaia-Clish.htm

Note the interfaces on a 3100 are not switch ports like that on a 600 however.

NAT is configured within SmartConsole along with your access policy & interface topology. For NAT the simple option is to enable the check box on the gateway object though this is not as flexible as defining manual hide-NAT rules

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

IWishIKnewMore — Thu, 27 Jan 2022 18:30:19 GMT

If specify my internet source as another router - it all works fine.
But if I try to use the modem per sk92768:
Could not connect to the Check Point Cloud. Check your connection settings (Default Gateway, DNS, Proxy)

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

Joseph_Audet — Thu, 27 Jan 2022 21:54:11 GMT

Try this: In the gaia web interface, go down to 'Advanced Routing -> Routing Options' and enable the checkbox for 'Kernel Routes' - this will allow the gateway to import the dynamically learned default route that it received from DHCP.

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

IWishIKnewMore — Thu, 27 Jan 2022 23:31:48 GMT

No change in the error - still:
Could not connect to the Check Point Cloud. Check your connection settings (Default Gateway, DNS, Proxy)

With or without the Modem IP hardcoded.

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

Chris_Atkinson — Fri, 28 Jan 2022 01:24:35 GMT

Once the routing has been verified further to Joseph's suggestion some other diagnostic measures may include:

External Interface topology: If the address you receive isn't static try specifying a dummy address of 0.0.0.0/32

Global properties: Menu > Gloabl Properties > FireWall > Access outgoing packets originating from Gateway: First.

Whilst on this screen its probably also beneficial to you to enable "Log Implied Rules".

Click OK and install policy.

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

the_rock — Fri, 28 Jan 2022 02:00:00 GMT

That error literally always mean that gateway can't reach cp update server. So try curl_cli updates.checkpoint.com and curl_cli cws.checkpoint.com commands and see what you get.

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

IWishIKnewMore — Fri, 28 Jan 2022 05:11:38 GMT

I felt like I was making progress - I finally got cert errors figured out and cpconfig enabled correctly.
I was into smart console:
- Enabled the Hide Nat Setting
- Enabled Autonomous IPS
-Enabled Base Firewall

Now I can't connect to SmartConsole anymore (Certificate Revoked).
GAIA via browser is "Secure Connection Failed"

It seems like if I do a cpstop/cpstart - there is a short window when I get the UI back, but then back to cert errors.

Two steps forward - one step.

Thanks for all the assistance - look forward to trying more things once I can get off just a putty connection 😉

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

Chris_Atkinson — Fri, 28 Jan 2022 05:29:03 GMT

Does "fw unloadlocal" from the CLI allow you back in to correct your policy/config.

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

IWishIKnewMore — Fri, 28 Jan 2022 13:09:09 GMT

fw unloadlocal - Fixed "Secure Connection Failed" and I can get back into GAIA.
SmartConsole is still (Certificate Revoked).

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

the_rock — Fri, 28 Jan 2022 13:12:11 GMT

Can you attach a screenshot of the smart console error? Try this...ssh into mgmt server and once you type cpconfig from expert mode, just click option for administrators and add new admin (this is for dashboard). Once you do this, it may ask to do cprestart and then try log in with that newly created user.

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

IWishIKnewMore — Fri, 28 Jan 2022 13:53:45 GMT

fw unloadlocal -> GAIA -> Certificate Authority Reset -> cprestart - Got rid of the "revoked" messaged.

Back to "Unable to Connect" or "The Operation Timed Out".

cpconfig -> re-add admin -> restart == didn't get any improvement.
^ (originally that's how I got into past those errors and into SmartConsole to begin with).

At least I can get into GAIA again, but a little unsure how to proceed from here.

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

the_rock — Fri, 28 Jan 2022 13:52:31 GMT

Ok, thats what I figured. So try do what I suggested and see if you can log in. Also, on mgmt server, run cpwd_admin list, as well as cd $FWDIR/scripts and then ./cpm_status.sh

Those commands would tell us if there is an issue with any process on your management server.

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

IWishIKnewMore — Fri, 28 Jan 2022 14:00:03 GMT

Miraculously SmartConsole just kicked over...didn't change anything from 5 minutes ago...but not going to argue it.
I guess my next question is what do I check for or set that I don't have to run telnet to "fw unloadlocal" and play firewall reset everytime the CP services restart....then maybe back to getting the modem connecting..sigh.. nothing is ever easy 🙂

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

the_rock — Fri, 28 Jan 2022 14:04:24 GMT

I hear ya brother : - ). Well, technically, every time firewall reboots, it should fetch latest known policy, so if you apply correct policy from mgmt server, than that's what would be on it after reboot. That way, you would never have to run fw unloadlocal command.

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

RS_Daniel — Fri, 28 Jan 2022 14:04:56 GMT

Hello,

Unfortunately Certificate Revoked has became a classic issue in Management server. Good news is that CheckPoint knows how to fix this: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113744

That link just explains the problem, bu it will take you to a second sk with the solution procedure:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk20905

Hope it helps you.

Regards

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

the_rock — Fri, 28 Jan 2022 14:07:22 GMT

I honestly never had that problem in 15 years dealing with CP. But, good links for the reference. Don't want to jinx it now : - )

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

IWishIKnewMore — Fri, 28 Jan 2022 22:20:16 GMT

I think I have some kind of lead on the modem - our least oddity:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk104417

dhcp.leases is blank for me. (with automatic ipv4 set or static set)

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

IWishIKnewMore — Fri, 28 Jan 2022 22:53:42 GMT

I figured out what happened. There is a "clean-up" rule. That applies when you enable the firewall blade. But neglects to set allow route for MGMT. The smartconsole logs were showing the dropped packets. With 192.168.X.0 to host address Accept defined - problem seems to have corrected.

Re: R81.10 - How to Setup WAN with Modem on eth1 and NAT/DHCP to eth2-5

Chris_Atkinson — Fri, 28 Jan 2022 23:50:12 GMT

Your Firewall is a DHCP client?

The SK is referring to it being set as a server for allocating IPs to LAN hosts.

Do you see a default route when you get the dynamic address or have you tried configuring one manually?

Can you ping the next-hop?

ifconfig -a ethX

netstar -nr

ping a.b.c.d

What IP Range should you receive from the modems DHCP, does it conflict with the existing firewall LAN addressing?