Configure Public IP address directly on a server behind Checkpoint

[kenn2000]

Hi Everyone,

We are in process of implementing Mitel MiCollab and the requirement is the WAN interface of the Micollab server should have public ip assigned directly on it. NATting from public ip to private ip does not support.

The MiCollab server is a VM behind the Checkpoint.

How could I achieve this setup with Checkpoint?

Thank you.

[_Val_]

setup a DMZ

[Chris_Atkinson]

As Val has hinted another interface/VLAN from the Check Point addressed with the public subnet and configuration pertinent for a DMZ.

[kenn2000]

Thank you all for your comments.

Sorry I am new to Checkpoint so needing your help further.

We currently have DMZ with a different subnet.

All public IPs have been forwarded to External on a bond Interface.

So I don't know how another DMZ network/Interface will work as what would be the IP address/subnet for them?. What I am understanding is each Interface should have a different subnet.

Could you please help explaining further?

Thank you very much.

[Chris_Atkinson]

Having public address on only the external interface cannot achieve this if the objective is not to use NAT.

The vendor of Firewall doesn't matter in this context.

Does the existing DMZ have/use public addresses (Y/N)?

Yes - Connect the Mitel here with an IP from that subnet.

No - You will likely have to create a new DMZ involving networking/routing changes & possibly requesting extra or new IP addresses from your ISP.

[Bob_Zimmerman · Accepted solution]

---

@Chris_Atkinson wrote:

Having public address on only the external interface cannot achieve this if the objective is not to use NAT.

---

Sure you can. It's really easy.

1. Pick a new network which will contain the MiCollab box. It can be private, and should be at least a /30 for a single firewall or a /29 for a two-member cluster.
2. Assign an IP in this network for the firewall. If using a cluster, also assign an IP for each member.
3. Assign the public IP to the MiCollab box.
4. Set the MiCollab box's default route to the private IP on the firewall's interface.
5. Add a 32-bit interface route pointing the public address out the firewall's interface connected to the network with the MiCollab box. The command to add this route will look like this:

set static-route 1.2.3.4/32 nexthop gateway logical eth1.2345 on

Due to a complicated set of requirements, I have a firewall which works like this in my environment. It's a bit weird to get used to, but pretty solid.

[Chris_Atkinson]

Thanks Bob, I was making an assumption from what was said that routing changes were out of scope or not possible due to the size of the existing external subnet.

[blacx_13]

Hi Bob,

I'm fairly new with checkpoint, i just have few clarifications with this solution. let me know if my assumptions are correct.

4. I am using a layer 2 switch on the DMZ, would this solution still work

5. Im a bit confused on the command will it be something like this based on the diagram
 

set static-route 1.1.1.2/32 nexthop gateway logical eth.xx (WAN) on

[Bob_Zimmerman]

4. Yes, you would need to use a switch. Having a router in the path makes things a bit more complicated, but still possible.

5. You don't have interface names on that diagram, but it would be 'set static-route 1.1.1.2/32 nexthop gateway logical <interface leading to the switch labeled DMZ> on'. You would then need to set the default route on 1.1.1.2 to be the cluster VIP on that interface. You should not use a public IP for that VIP.

[blacx_13]

btw, this is not a part of a cluster. so it would be something like this ? since I dont have any VIP
 'set static-route 1.1.1.2/32 nexthop gateway eth3 (20.20.20.1 interface) on'

[Bob_Zimmerman]

set static-route 1.1.1.2/32 nexthop gateway logical eth3 on

And remember, you need to set the endpoint's default route to the firewall's address on eth3. You may also need to give the endpoint a route to the firewall's address telling it to go out a particular interface. The right way to set all that up depends on the OS on the endpoint.

[Vladimir]

Depending on the size of your public IP network, this could be accomplished by breaking it into smaller subnets.

Create DMZ using one of the small subnets with public IPs and place your Mitel unit in it.

You will have to configure static routes on the ISP router to forward traffic destined to individual subnets to use Check Point's external IP as the gateway.

[kenn2000]

Thank you @Bob_Zimmerman , @Chris_Atkinson and everyone for tipping the idea.

I now understand how it can be done. It is more complicated that I first thought where it could be just simply a special config in Checkpoint to bridge the traffic directly to Micollab in DMZ.

Will need to involve more parties into the solution.

Much appreciated.