Checkpoint 3000 Multiple Public IP Ranges

[bradrmorris]

We are in the process of migrating off our existing firewalls to a Checkpoint XL Cluster.  We currently have 2 different Public IP Ranges from our ISP.  The interfaces of our existing firewall are assigned IPs from one ranges (range 1) as well as having other manual NAT Rules for IPs in this range.  We then have NAT Rules for IPs in the other range (range 2) that work even though we don't have any physical interfaces with IPs in this range. 

So far on the checkpoints I am only able to get NAT rules working for one IP Range which is the same range we are using on the Interfaces.  Is there a way to get our Second IP Range working without having to assign IP From that range to an interface?

[_Val_]

Please share the version is use. Also, a diagram with some (even bogus) IP addresses would help. From the description alone, it seems to be possible to achieve your goal, so it is unclear what is your actual issue. Please elaborate.

[bradrmorris]

Thanks _Val_,

We are running version R81.   We have also setup the Manual NAT rules for the IPs in the other range along with Proxy ARP entries, but this did not seem to help.  When running "fw ctl arp" I see an entry for NAT rules when the PUblic IP is in the range of our External Interface, but when I create a rule using a Public IP from our other range nothing ever shows up.

[_Val_ · Accepted solution]

@See the question below from @Chris_Atkinson 

I think routing is the issue here. That Cisco ASA there is not really helping. Why not routing all to CP FW?

[bradrmorris]

Thanks _Val_,

I might need to reach back out to the ISP.  My understanding is that the ISP's device didn't have routes to our devices, but I might need to confirm that.  We were trying to have the ASA and Checkpoint up in parallel and migrate things over.

[bradrmorris]

Hey _Val_

I believe I found what I was missing.  I was reading up more on Proxy ARP and found that we needed to have the setting "Merge manual proxy ARP Configuration" enabled under global properties, and we did not.  Once I enabled this everything started working as expected with the 2nd Range of Public IPs.  Thanks for your assistance.

[Chris_Atkinson · Accepted solution]

Subnet1 sounds like it might be using Proxy-ARP.

Has Subnet2 been routed towards the firewall by the ISP?

[bradrmorris]

Hey Chris,

I might have to reach back out to our ISP.  It was my understanding that the ISP's device didn't have routes to our devices, it was just a Gateway that we routed to.  When we assigned an IP to the Checkpoint device it worked instantly without a route on the ISP device.  I am going to contact them to verify either way.  I wonder if I just need the right combination of Proxy-ARP and routs for the second range on our CP device.  Thanks.

[bradrmorris]

Hey Chris,

I believe I found what I was missing.  I was reading up more on Proxy ARP and found that we needed to have the setting "Merge manual proxy ARP Configuration" enabled under global properties, and we did not.  Once I enabled this everything started working as expected with the 2nd Range of Public IPs.  Thanks for your assistance.