topic Re: Can someone please clear my doubts about CP Network? in Firewall and Security Management

Can someone please clear my doubts about CP Network?

Blason_R — Sun, 03 Jul 2022 13:43:12 GMT

Hi Team,

We are planning to use a topology given below.

I am planning to use Check Point default gateway as 1.2.3.5 which is LB. Server 10.10.10.30 is statically manually natted with 1.2.3.7

Proxy ARP added on firewall.

From Check Point perspective I wanted to understand the routing part in the below scenario

Lets support Traffic is initiated from Internet for host 1.2.3.7 for Port 443
It would reach router R1
It would Broadcast for ARP. Check Point would send gratuitous ARP
Traffic will then be forwarded to 1.2.3.6
Traffic will be natted and send out to 10.10.10.30
Now while returning from 10.10.10.30

Once it reached to Check Point

Does firewall refer to the routing table for destination ANY (Since the packet was originated from Source ANY) and will it be routed to 1.2.3.5; causing asynchronous routing

Since the firewall already has connection table entry and it knows it arrived from eth0 from 1.2.3.4; will it be routed back to 1.2.3.4?

My strong feeling is it would definitely be sent it back to 1.2.3.4 since routing is not stateful and I would need to add PBR on CP for source IP

Please advise?

Re: Can someone please clear my doubts about CP Network?

Chris_Atkinson — Mon, 04 Jul 2022 04:27:31 GMT

Please clarify the diagram further by specifying subnet masks and is the LB itself performing any NAT?

Generally the most specific route will be followed.

Re: Can someone please clear my doubts about CP Network?

Blason_R — Mon, 04 Jul 2022 05:50:43 GMT

You can consider those all are in same network. Lets say /27

Nope Static nat will be configured on Check Point. So that Incoming traffic for Application server will be natted on Check Point firewall and will be forwarded to the server. While Outbound traffic from hosts which is a hide nat will be configured on LB. So the default gateway for Check Point is LB.

Re: Can someone please clear my doubts about CP Network?

Chris_Atkinson — Mon, 04 Jul 2022 05:58:26 GMT

Remember connected/specific routes are preferred over the default, so the source you mention probably will have a different behavior in this case if it's part of a /27.

Re: Can someone please clear my doubts about CP Network?

Blason_R — Mon, 04 Jul 2022 06:02:12 GMT

Yes that I agree and in this scenario - There are no specific routes. I agree least routes will match first and before that even PBRs are matched. However in this scenario; no specific routes are added and only a default gateway is pointed to LB. I am wondering if reverse traffic for statically natted IPs which is a part of established session will it be routed to LB or Router since it know that traffic is received from R1 through eth0

Re: Can someone please clear my doubts about CP Network?

Paul_Kazzi — Tue, 05 Jul 2022 01:57:41 GMT

Are you NATing the source IP too? Does internet host's source IP change when traversing environment via R1?

If not, then I am pretty sure you will have an asymmetric routing issue if your default gateway points to LB, whereby the return traffic from 10.10.10.30 will flick to LB from CP.

Re: Can someone please clear my doubts about CP Network?

Blason_R — Tue, 05 Jul 2022 02:46:47 GMT

Nope I am not natting Source IP. Source IP is gone be = Original. And I am pretty sure it would cause asymmetric routing issue however wanted to confirm once. Thanks though.

Re: Can someone please clear my doubts about CP Network?

Paul_Kazzi — Tue, 05 Jul 2022 03:57:48 GMT

You could test on R1 NATing source IP to an R1 source to force reply back to R1. Obviously subject to testing as unsure of environment specifics 🙂

Re: Can someone please clear my doubts about CP Network?

Blason_R — Sat, 30 Jul 2022 03:29:09 GMT

I was right as it would definitely refers the route.