Are you a member of CheckMates?
×
Sign in with your Check Point UserCenter/PartnerMap account to access more great content and get a chance to win some Apple AirPods! If you don't have an account, create one now for free!
1 Solution
Accepted Solutions
Thanks Vlad but ...
1. there is no switch in between - just int to int between one firewall and another (Fortigate <-> CheckPoint)
2. there are no L2 configs - just plain static route but when querried ip r g 192.168.16.0 it shows totally diff. direction - via eth1 (wrong!)
3. L1 is just fine (links are up) and both interfaces are blinking green 
next hope should be reachable as it is configured plainly as eth1 on Forti with 10.10.10.4/29 with static route against nets behind CP with next hope 10.10.10.3
any ideas chaps?
I'll find out next week just made following recommendations to the "Fortigate Team" in New Zeland
- connect little 4-8 port switch to the Fortigate DMZ Port
- connect pachcords between two eth3 ports from CheckPoints to the swithc
- connect pachcord between one dmz port from Frotigate to the switch
- let me know when done
I've made a Cluster with VMAC on ClusterXL with 10.10.10.1 (2/3 physicals) and let's see how it goes when little switch arrives
Unfortunately I have no ways ot flying over there just for few days (not now!) as this site is very remote (Hamilton NZ) and the IT Team is just on-demand helping me with the migrations.
Thanks Vlad anyway, I'll keep you posted when next week "little netgear switch" won't solve my problems. I do know that theoretically it should work but this is the peering ClusterXL with Fortigate over 1G cooper port super simple and complicated at the same time LOL
have a good weekend!
ok. here is a proper update for you all, should anyone knows what a heck I'm doing wrong (*wink*) - do let me know
obviously I was following IN DETAIL sk86582 but,:
exec ping 10.10.10.1 (from Fortigate CLI on 10.10.10.4)
5 packets transmitted, 0 packets received, 100% packet loss
whilst on zdebug on CP Cluster:
;[cpu_1];[fw4_0];fw_log_drop_ex: Packet proto=1 10.10.10.4:2048 -> 10.10.10.1:5649 dropped by vpn_drop_and_log Reason: Clear text packet should be encrypted;
when $FWDIR/lib/crypt.def (on SMS + successfuly pushed is like following:
vpn_exclude_src1={<192.168.16.0,192.168.16.254>};
vpn_exclude_dst1={<a.a.a.1,a.a.a.254>};
vpn_exclude_src2={<10.10.10.0,10.10.10.255>};
vpn_exclude_dst2={<10.10.10.0,10.10.10.255>};
vpn_exclude_src3={<a.a.a.1,a.a.a.254>};
vpn_exclude_dst3={<192.168.16.0,192.168.16.254>};
with following in a proper place as well:
((src in vpn_exclude_src1) and (dst in vpn_exclude_dst1)) and ((src in vpn_exclude_src2) and (dst in vpn_exclude_dst2)) and ((src in vpn_exclude_src3) and (dst in vpn_exclude_dst3))
ps. all in right space, spot and policy installed - just simply DOES NOT WORK and I cannot ping whatever direction I'll take based on the exclude_objects from above.
any clue chaps ?
