topic Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch in Firewall and Security Management

CheckPoint bridge mode is not working between the Fortigate and H3C switch

BlueGrass — Mon, 17 Feb 2020 12:13:39 GMT

-------

17/2/2020

-------

Add screen capture on the below reply for further troubleshooting.

-------

16/2/2020

-------

HI all,

I just have a Checkpoint as bridge mode and have a scanning over the Trunk link.

Both Fortigate and H3C has a Trunk link up already before. Vlan 10 is tagged with untagged VLAN 1.

All my users are in Vlan 10.

They need to have both CP and FG scanning while visiting the internet.

Then we set up port 3 and 4 as br1 on the Check point.

FortiGate connects to p3 while h3c switch uplink to p4.

Both p3 and p4 are in the Internal zone with anti-spoofing disabled.

CP Firewall policy just has the clean up one with any to any accepted.

From the debug flow on FortiGate, I can not find the traffic to the internet, let says the dst. is "1.1.1.1"

Nevertheless, both 192.168.100.1 and 172.16.10.101 can ping mutually and have the debug log result from Fortigate.

I think this proves the CP policy working well?

Interestingly, both Firewall traffic Logging reveal the traffic is accepted if to the internet.

Only no outcome from the debug log result from Fortigate if the dst. is to internet or "1.1.1.1"

I swear to god that FortiGate original settings are good.

As we use it before and everything just normal.

Please someone helps.

Below is the lab topology after the deployment.

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

_Val_ — Fri, 14 Feb 2020 14:38:32 GMT

Do you see the traffic forwarded on Check Point through the bridge? Simple "fw monitor" would answer this question

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

_Val_ — Fri, 14 Feb 2020 14:39:44 GMT

and by the way, do you have _another_bridge_ on Check Point for VLAN10?

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

BlueGrass — Sun, 16 Feb 2020 06:02:18 GMT

From the Firewall policy, I can find the traffic is passed.

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

BlueGrass — Sun, 16 Feb 2020 06:03:10 GMT

Only Br1 is on the Checkpoint.

I even try no both tag vlan 10 and tagged Vlan 10 to Br1 also.

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

BlueGrass — Sun, 16 Feb 2020 06:04:08 GMT

So is Fortigate side, I can find the traffic is passed.

But no idea why the traffic debug flow can not find the related traffic.

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

Chris_Atkinson — Sun, 16 Feb 2020 10:09:33 GMT

I assume NAT is disabled on the Check Point gateway, what other controls are active?

(Refer also sk101371,sk106319)

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

BlueGrass — Mon, 17 Feb 2020 02:07:58 GMT

Yes, NAT is disabled on the Check Point gateway level already.

Only the general UTM blades like AntiVirus, IPS, Web filter.

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

Chris_Atkinson — Mon, 17 Feb 2020 02:13:19 GMT

Is your firewall and URLF/AppC policy consolidated or in separate layers currently?

Regarding the destination, is it always specified as "Any" versus "Internet" in _all_ applicable rules...

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

BlueGrass — Mon, 17 Feb 2020 12:12:27 GMT

Take a quick look at it:

I try to rebuild the Br1 into Port1 and 2, downgrade to R80.10 and replace the H3C to Cisco 2960 now.

Still no luck.

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

BlueGrass — Mon, 17 Feb 2020 12:15:53 GMT

Screen for your referencing:

No output from fw ctl zdebug drop.

And Ping result if to 9.9.9.9:

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

_Val_ — Mon, 17 Feb 2020 12:23:08 GMT

It is showing Check Point FW is not a problem here. Look outside for some external failure

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

BlueGrass — Mon, 17 Feb 2020 12:55:32 GMT

The Big O is not appearing from 172.16.10.101 I think?

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

_Val_ — Mon, 17 Feb 2020 13:05:03 GMT

Uh, I was looking at interface names and did not look at IPs.

You are correct, it seems FW is NAT-ing the connections, which should not happen on the bridge in the first place. Check your NAT policies.

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

BlueGrass — Mon, 17 Feb 2020 13:24:44 GMT

Please have a look at the latest reply.

I have the NAT screen for it.

I even try manually have one to force everything translated as original ...

Well, still the same.

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

_Val_ — Mon, 17 Feb 2020 13:32:21 GMT

10.20.30.1 - who's this IP belonging to?

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

Chris_Atkinson — Mon, 17 Feb 2020 13:42:42 GMT

Per Val's comment, please double check the NAT options/settings on the Gateway object itself.

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

BlueGrass — Mon, 17 Feb 2020 13:36:24 GMT

That is Checkpoint Br1 ip address before.

I use that for Vlan 1 and mgt ip for UTM update.

Interestingly, 10.20.30.1 is good to passthrough Fortigate over the trunk and access internet

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

BlueGrass — Mon, 17 Feb 2020 13:40:40 GMT

Bro, I check it more than 10 times really.

No box in NAT of the gateway was checked.

Re: CheckPoint bridge mode is not working between the Fortigate and H3C switch

_Val_ — Mon, 17 Feb 2020 13:52:16 GMT

can you please post Bridge config from Gaia and also the GW topology tab?