topic SSH connection failed when it go through the firewall/across VLANs. in Firewall and Security Management

SSH connection failed when it go through the firewall/across VLANs.

Sung — Wed, 12 Jul 2023 00:52:19 GMT

Hello everyone.

As shown as attached, we use Checkpoint 3600 as our gateway and connect it to our core switch.

We observed that SSH connection from VLAN-A to VLAN-B is failed.
For example, We use laptop with VLAN10 IP to SSH access Cisco network switch which with VLAN20, but connection is failed.
We use SSHv2 and observed Checkpoint firewall accept SSHv2 on log level, but connection is failed.At the same time there is SSHv1 releated drop log but do not know if SSHv2 connection failed and SSHv1 drop log are connected or not.

Also, we tryied using the same laptop with VLAN20 IP and observed SSHv2 connection is worked.
We did not filter anything on Cisco switch and also observed the same behavior with other platform like Cisco 9200 and HP A5800 network switch.Therefore, we believe that it fails only when packet go through the firewall/across VLANs.
Could anyone share how to investigate futher on Checkpoint or solve this issue? Thanks.

Re: SSH connection failed when it go through the firewall/across VLANs.

the_rock — Wed, 12 Jul 2023 01:13:37 GMT

I will give you basic command I would do first, it should provide an idea as to why it fails. So, lets pretend IP involved is 1.2.3.4 trying to ssh

You could do this from expert on the fw -> fw ctl zdebug + drop | grep 1.2.3.4 | grep "22"

You can run same command just grepping for port 22

Alternatively, you can also do fw monitor -e "accept host(1.2.3.4) and port(22);"

There is also fw monitor -F filter, which is real good, so say src is 1.2.3.4 and dst is 2.3.4.5 and dst port is 22, it would look like below

fw monitor -F "1.2.3.4,0,2.3.4.5,22,0" -F "2.3.4.5,0,1.2.3.4,22,0"

Idea is this "srcip,src port, dst ip, dst port, protocol"

Needless to say, you dont care about src port, as its totally irrelevant.

Hope that helps.

Andy

Re: SSH connection failed when it go through the firewall/across VLANs.

Sung — Fri, 21 Jul 2023 05:24:56 GMT

Thank you. Will check with these debug commands and see what can we see.