topic Re: Proxy ARP on SMB in Spark Firewall (SMB) https://community.checkpoint.com/t5/Spark-Firewall-SMB/Proxy-ARP-on-SMB/m-p/82362#M3441 If the issue is seeing the private IP on the public side, it's not a proxy arp issue, it's something else.<BR />Probably something the TAC needs to investigate. Sun, 19 Apr 2020 03:15:09 GMT PhoneBoy 2020-04-19T03:15:09Z Proxy ARP on SMB https://community.checkpoint.com/t5/Spark-Firewall-SMB/Proxy-ARP-on-SMB/m-p/81827#M3416 <P>Hi,</P><P>I'm not sure if it is the Proxy ARP the problem but I'm running an issue with SMB 1490 (77.20.87 990173004) centrally managed via a DMS R80.20.</P><P>Often an IPSEC tunnel through the 1490 it goes down and the issue it seems NAT related. I did a capture on the inside interface (P2P with the Cisco Router and the CP 1490) when the IPSEC tunnel was down and some packets are not translated properly.</P><P>In the capture I see the private IP of the P2P interace instead of the Public one, if I shut/no shut the tunnel on the cisco router, then it starts to work again and the packet are trasleted porperly.</P><P>Since we have manual NAT rules configured (because we have also load balance in place) I'm not sure if the Proxy ARP settings are correct.</P><P>&nbsp;</P><P><STRONG>NAT Rules are defined (before automatic rules) as below:</STRONG></P><P>No | Oiginal Source&nbsp; |&nbsp; original Destination&nbsp; &nbsp; |&nbsp; &nbsp;Service&nbsp; &nbsp; |&nbsp; &nbsp; Transl. Source&nbsp; &nbsp; |&nbsp; &nbsp;Transl. Destination&nbsp; &nbsp; |&nbsp; &nbsp; Transl. Services&nbsp; &nbsp;|</P><P>1.&nbsp; &nbsp;|&nbsp; Cisco (Priv.IP)&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Any&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; &nbsp; &nbsp; Any&nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; Public IP ISP1&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; Original&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; &nbsp; &nbsp; &nbsp;Original&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |</P><P>2.&nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp;Any&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; Public IP ISP1&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; Any&nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Original &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; Cisco (Priv.IP) &nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp;Original&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |</P><P>3.&nbsp; &nbsp;|&nbsp; Cisco (Priv.IP)&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Any&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; &nbsp; &nbsp; Any&nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; Public IP ISP2&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; Original&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; &nbsp; &nbsp; &nbsp;Original&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |</P><P>4.&nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp;Any&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; Public IP ISP2&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; Any&nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Original &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; Cisco (Priv.IP) &nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp;Original&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |</P><P>&nbsp;</P><P>In Global Properties I had only Automatic ARP Configuration and I just enabled also Merge Manual proxy ARP configuration. I did this change just this morning so it's under monitoring but I would like to know if any others changes are required under $FWDIR/conf/local.arp.</P><P>&nbsp;</P><P>Thank you!</P><P>Regards</P><P>&nbsp;</P><P>Francesco</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 14 Apr 2020 15:55:29 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/Proxy-ARP-on-SMB/m-p/81827#M3416 Francesco_Scati 2020-04-14T15:55:29Z Re: Proxy ARP on SMB https://community.checkpoint.com/t5/Spark-Firewall-SMB/Proxy-ARP-on-SMB/m-p/81878#M3421 Are you using the same private IP in rules 1 and 3? Tue, 14 Apr 2020 22:30:54 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/Proxy-ARP-on-SMB/m-p/81878#M3421 PhoneBoy 2020-04-14T22:30:54Z Re: Proxy ARP on SMB https://community.checkpoint.com/t5/Spark-Firewall-SMB/Proxy-ARP-on-SMB/m-p/81898#M3425 Hi,<BR />in the original source and in translated destination yes it's the same Ip due to the ISP Redundancy but also disabling the rules nr.3 and nr.4 the behavior it's the same.<BR /><BR />Thank you.<BR /><BR />Francesco.<BR /> Wed, 15 Apr 2020 05:44:35 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/Proxy-ARP-on-SMB/m-p/81898#M3425 Francesco_Scati 2020-04-15T05:44:35Z Re: Proxy ARP on SMB https://community.checkpoint.com/t5/Spark-Firewall-SMB/Proxy-ARP-on-SMB/m-p/82362#M3441 If the issue is seeing the private IP on the public side, it's not a proxy arp issue, it's something else.<BR />Probably something the TAC needs to investigate. Sun, 19 Apr 2020 03:15:09 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/Proxy-ARP-on-SMB/m-p/82362#M3441 PhoneBoy 2020-04-19T03:15:09Z