topic Re: Use specific internal IP for connection from Checkpoint 1430 in Spark Firewall (SMB)

Use specific internal IP for connection from Checkpoint 1430

Basyuk — Fri, 29 Jan 2021 06:36:09 GMT

Hello!

I would like to run a script for copy file from server on checkpoint 1430, but it's accessed from external IP.

In sk119415 was recommended use command fw ctl set int fw_enc_conns_use_internal 1

If you use this command checkpoint, then checkpoint uses any internal IP from its interfaces.

How can I set a specific IP for this purpuse?

Firmware version 77.20.87

Re: Use specific internal IP for connection from Checkpoint 1430

G_W_Albrecht — Fri, 29 Jan 2021 08:44:51 GMT

In sk119415 we learn about IPSec VPN tunnels peer IPs - you can select using Advanced Settings to use internal IP for VPN tunnels on locally managed SMB, or using fw ctl set int fw_enc_conns_use_internal 1 on centrally Managed SMBs. There is no way to set it to a specific internal IP, but you can try to define a Bridge with the internal IP you want and add all LAN ports (or a Switch with all LAN ports) and WLAN. For outgoing IPSec, this internal IP should be used.

So please explain which client should start a copy from server to which target ?

Re: Use specific internal IP for connection from Checkpoint 1430

Basyuk — Fri, 29 Jan 2021 09:08:57 GMT

Thank you, but I am not understand method with use Bridge.

For exaple:

My SMB device has a two interfaces with subnet (LAN1 - 10.1.1.1, LAN2 - 172.30.1.1).
Or SMB has a one interface with two vlans (LAN1.1111 - 10.1.1.1, LAN1.1112 - 172.30.1.1)

I use SmartProvisioning for run script, that writes interfaces configuration to the file and copy this file to my PC (use SCP).

I have the ability to allow access to my PC only from 10.1.1.1.

How can I do it?

Re: Use specific internal IP for connection from Checkpoint 1430

G_W_Albrecht — Fri, 29 Jan 2021 09:21:42 GMT

I am sorry, but i do not understand where the IPSec VPN tunnel comes in here. Bridge is fully covered in the Admin Guide, i would start with it first.

Re: Use specific internal IP for connection from Checkpoint 1430

Basyuk — Fri, 29 Jan 2021 09:25:30 GMT

My computer is located behind another checkpoint.

Re: Use specific internal IP for connection from Checkpoint 1430

G_W_Albrecht — Fri, 29 Jan 2021 09:37:14 GMT

Oh, you want to manipulate the source IP so it does not come from WAN IF but internal SMB IF. Better idea: Let the script send it to a watched client folder in this SMBs local network first and resend it to you from that client 8)

Re: Use specific internal IP for connection from Checkpoint 1430

Basyuk — Fri, 29 Jan 2021 09:44:52 GMT

At this moment I am using the following method:

1. Enable bashUser for admin and run my script in SmartProvisioning

2. Run script from my PC that copy this files to my PC with help putty (pscp)

3. Disable bashUser for admin

I thought there was a way to do it through SmartProvisioning:(