topic Re: Check Point 1450 Appliance Several External IP in Spark Firewall (SMB)

Check Point 1450 Appliance Several External IP

vitaliyb — Tue, 02 Jul 2019 11:29:46 GMT

Hi, all.

I am a newbie with Check Point products.

I have Check Point 1450 in my company. ISP bring us a network with /29 mask.

Now I can assign only one IP to External interface.

How can I let to work another 4 IP's?

Re: Check Point 1450 Appliance Several External IP

PhoneBoy — Wed, 03 Jul 2019 00:58:16 GMT

What is the configuration of the WAN interface?
Is this 1450 centrally managed or locally managed?

Re: Check Point 1450 Appliance Several External IP

vitaliyb — Wed, 03 Jul 2019 03:06:23 GMT

1450 localy managed.

Re: Check Point 1450 Appliance Several External IP

PhoneBoy — Wed, 03 Jul 2019 03:50:03 GMT

Few ways to do it:

Put the relevant hosts on the WAN side of the firewall and assign them one of your four remaining IPs. Obviously the 1450 won't be protecting these hosts.
Create Server objects (Users and Objects > Servers) for the hosts you want to use the public IP addresses. In Step 2 of the Wizard, you specify the private IP address of the system in question. In Step 4, you specify the public IP you want the system to be accessible by.
Create manual NAT rules (Access Policy > Firewall > NAT).

Re: Check Point 1450 Appliance Several External IP

vitaliyb — Wed, 03 Jul 2019 04:32:01 GMT

Thanks for reply.

I think I have not accurately explained what I want to get in the end.

By now all works fine, but with only one IP.

Look at pic.

Ideally Server1 must be publish by IP1. Server2 by IP2 & etc.

Is it real?

Re: Check Point 1450 Appliance Several External IP

G_W_Albrecht — Wed, 03 Jul 2019 08:51:17 GMT

Step 4

Re: Check Point 1450 Appliance Several External IP

vitaliyb — Wed, 03 Jul 2019 10:35:49 GMT

Thanks, but it didn't work for me.

I do all like you say, but in Logs nothing that refer to Second IP.

Look at pic. Blue rule work fine. Red rule don't.

Re: Check Point 1450 Appliance Several External IP

PhoneBoy — Wed, 03 Jul 2019 18:00:33 GMT

If you do a tcpdump on the WAN interface when someone tries connecting to the .75 address, what do you see?

Re: Check Point 1450 Appliance Several External IP

vitaliyb — Thu, 04 Jul 2019 03:36:56 GMT

Packet Capture show nothing with IP .75

I try ping, telnet to port 5555. no mention of the address .75

Re: Check Point 1450 Appliance Several External IP

vitaliyb — Fri, 05 Jul 2019 03:33:42 GMT

Hi, all.

Yesterday I was try localize problem.

I build this scheme. Results was:

1. IP .75 reply to ping

2. all rules works fine. (Thanks to @G_W_Albrecht and @PhoneBoy )

But! It all works only with my laptop with IP .76

All other addresses from different subnet can't connect to IP .75

It looks like "virtual interface with IP .75" has no default-gateway on it.

Can someone explain me whats going on?

Re: Check Point 1450 Appliance Several External IP

PhoneBoy — Fri, 05 Jul 2019 23:13:57 GMT

What you should see on a tcpdump from the gateway when someone tries to connect to .75 is an ARP request that looks something like this:

16:09:32.652969 ARP, Request who-has x.y.z.75 tell x.y.z.73, length 28

The fact it's working from your PC connected at .76 suggests the gateway is doing exactly what it's supposed to do.
The fact it doesn't work in other scenarios suggests a configuration issue with your ISP router.

Re: Check Point 1450 Appliance Several External IP

vitaliyb — Tue, 03 Sep 2019 06:22:14 GMT

Hi for all.
Problem was solved by changed provider's "last mile" equipment.
I try to solve problem with Checkpoint Support Team. Let him to connect to my 1450. No changes.
Finally we decided to change the type of connection to the provider and problem was gone.
Thanx for all who try to help me.