topic Re: Unable to ping Checkpoint Gateway ip from gns3 router in General Topics

Unable to ping Checkpoint Gateway ip from gns3 router

Nick_Shah — Sat, 04 Apr 2020 18:38:52 GMT

Hello,

Any help/suggestion is appreciated.

I am new to checkpoint and have started learning. I am trying to set up lab for this in Vmware. I am almost done. The problem is i am unable to ping Checkpoint Gateway IP from Gns3 router or vice versa. Both share the same Vmnet adapter(subnet). I can see the logs but unable to ping. Tried many things but no luck

Please help

However I am able to ping Checkpoint gateway from Checkpoint Manager.

Logs

Topology

VMnet adapter Setting

Thanks

Re: Unable to ping Checkpoint Gateway ip from gns3 router

PhoneBoy — Sun, 05 Apr 2020 03:09:17 GMT

Does the router in gns3 have a route configured for the 192.168.197 subnet?

Re: Unable to ping Checkpoint Gateway ip from gns3 router

Nick_Shah — Sun, 05 Apr 2020 05:16:57 GMT

Hello PhoneBoy,

Thanks for replying, yes default route is present in gns3 router. Although it is directly connected network, it should ping even if there is no route.

Re: Unable to ping Checkpoint Gateway ip from gns3 router

Nick_Shah — Sun, 05 Apr 2020 08:56:24 GMT

Hi,

yes, Gsn3 router has default route. although this is directly connected network even without default route it should ping

Thanks

Re: Unable to ping Checkpoint Gateway ip from gns3 router

Nick_Shah — Thu, 09 Apr 2020 09:40:26 GMT

Please suggest ..

Thanks

Re: Unable to ping Checkpoint Gateway ip from gns3 router

AlekseiShelepov — Thu, 09 Apr 2020 10:42:52 GMT

Could you show what you have configured in Network Management settings of the gateway and what are the general settings of both interfaces from SmartConsole?

Re: Unable to ping Checkpoint Gateway ip from gns3 router

Nick_Shah — Sat, 11 Apr 2020 15:13:20 GMT

Hello,

Please find the setting below

Checkpoint gateway interface eth0 ip which goes to checkpoint manager

Checkpoint gateway eth0 ip

Checkpoint gateway eth1 ip which goes to gns3 router

Checkpoint gateway eth1 ip

Ping from checkpoint manager cli

ping from manager to gateway

Checkpoint manager interface eth0 ip which is connected to gateway

Checkpoint Manager eth0 ip

Ping from local pc to gateway and manager, unable to ping gateway but can ping manager int ip

My pc ip is 192.168.0.7/24

unable to ping checkpt gateway but can ping manager ip

Gateway vmnet network adapter setting

vmnet setting of checkpoint gateway

Manager vmnet network adapter setting

Vmnet setting of Checkpoint manager

Vmnet network setting

Vmware netwrok setting

Please let me know what i can do to run whole setup. I tried disabling windows firewall but no luck. I also want connectivity from gateway to gns3 router. I am using cloud(vmnet1 to router interface Gi0) to connect gns3 router to checkpoint gateway. Please suggest

Thanks.

Re: Unable to ping Checkpoint Gateway ip from gns3 router

PhoneBoy — Sun, 12 Apr 2020 02:51:44 GMT

The endpoints need to know how to route traffic to each other.
What is the precise routing table on:

1. Your management VM (the one at 192.168.0.10)--get that with the command route print. There needs to be a route for 192.168.197.0.24 in there somewhere.
2. Your gns3 router--refer to the appropriate documentation. There needs to be a route in there for 192.168.0.0/24.

If either end is missing the correct route, then you will not be able to ping.

Re: Unable to ping Checkpoint Gateway ip from gns3 router

Nick_Shah — Sun, 12 Apr 2020 04:33:54 GMT

Even though gns3 router has default route towards gateway, it cannot ping directly connected network (192.168.197.x/24). I have posted all snaps. I have also allowed policy from router to gateway on smartconsole. Not sure whats missing.. 😥😔

Thanks.

Re: Unable to ping Checkpoint Gateway ip from gns3 router

PhoneBoy — Sun, 12 Apr 2020 06:38:17 GMT

If you do a tcpdump on the gateway interface facing the gns3, what do you see?

Re: Unable to ping Checkpoint Gateway ip from gns3 router

Timothy_Hall — Sun, 12 Apr 2020 12:59:31 GMT

Is the IP address of the GNS3 router 192.168.197.52 or 192.168.197.152? Your diagram says .52 but your rule allowing ICMP says .152. Assuming that is not the problem, from GNS3 try to ping the firewall at .151, then immediately display the ARP cache on the GNS3 router. Is the GNS3 router able to successfully map a MAC address to the firewall's IP address .151? If yes the firewall is blocking it (probably due to the typo in your rulebase, but you can run fw ctl zdebug drop on the firewall and try the ping again to see why it is being dropped otherwise). If no MAC address is shown with the firewall's IP address on the GNS3 router, you have a connectivity problem (or an IP configuration problem) between the GNS3 router and the firewall in VMWare.

Re: Unable to ping Checkpoint Gateway ip from gns3 router

Nick_Shah — Mon, 13 Apr 2020 06:16:22 GMT

Hi Timothy Hall,

Gns3 router has 192.168.197.152 ip address configured. By mistake its .52 in diagram. Please find below output

Ping from Gns3 router to gateway ip. The yellow colour highlighted logs is when i tried pinging from gateway to router interface IP. I tried disabling my windows firewall, but no luck. whats shall i do to make this work.

fw ctl zdebug drop output from gateway.

Gns3 Vmsetting (192.168.197.x/24 running on Vmnet1)

Gateway Vmnet setting (Vmnet 1 connected to Gns3 and vmnet2 checkpoint manager)

All VMnet IP setting

Thanks,

Nick

Re: Unable to ping Checkpoint Gateway ip from gns3 router

FraP — Mon, 13 Apr 2020 10:59:23 GMT

Hi Nick,

do you have this behaviour just wih icmp or also with ssh?
Taking a look to "debug arp" provided, it's seem R1 get an arp reply from the gateway at 05:03:46.371, after several failed attempts...

Can you check if this entry is then kept in R1 arp table?
What about gateway prospective? Can you check if it's aware of arp entry for R1 G10 intf ip, and from your computer?

arp -a

Check please the network driver configured in .vmx file (for each vm). The relevant row starts with:

ethernet0.xxxxx
ethernet1.xxxxx

and the driver used on the gateway via ethtool -i eth1

As previusly suggest,could be usefull perform a tcpdump -i any -e on the gateway before the ping to see if all the arp requests are seen

Re: Unable to ping Checkpoint Gateway ip from gns3 router

Daniel_Schlifka — Mon, 13 Apr 2020 13:46:13 GMT

Hi,

what happens if you run cpstop?
Would be interesting to see if the issue persists when no policy/fw kernel is in the way.

Re: Unable to ping Checkpoint Gateway ip from gns3 router

Rajendra10 — Sat, 23 May 2020 18:15:44 GMT

run below command on gateway and try to ping.

gateway> fw unloadlocal