- Products
- Learn
- Local User Groups
- Partners
- More
CheckMates Fifth Birthday
Celebrate with Us!
days
hours
minutes
seconds
Join the CHECKMATES Everywhere Competition
Submit your picture to win!
Check Point Proactive support
Free trial available for 90 Days!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
The 2022 MITRE Engenuity ATT&CK®
Evaluations Results Are In!
Now Available: SmartAwareness Security Training
Training Built to Educate and Engage
MITRE ATT&CK
Inside Check Point products!
CheckFlix!
All Videos In One Space
Good day.
Help me to solve the following problem:
1. We have a dedicated management server (M) with a local IP address (10.1.0.100)
2. In the local network, there are several firewalls A and B (HW 5000) (10.1.1.200 and 10.2.1.200)
3. Outside the local network, we have branches in which the firewalls C, D, E (HW 1400), etc. are located. (1.1.1.1,2.2.2.2,3.3.3.3)
During the configuration of this topology, the problem of adding firewalls of branches (C, D, E) to the management server.
In order for the branch firewalls to see the management server from the outside(internet) and be able to interact with it, an automatic static rule was made (ext IP 5.5.5.5) and the function "Apply for SG control connections" is enabled
In this configuration, the branch firewalls work fine, but the local firewalls do not interact with the management server since they attempt to establish a connection with mng server (M) to an external address configured with a static nat.
How to be in this situation?
Have you checked the sk100583 - Troubleshooting "SmartCenter behind NAT" issues?
If not, look at the Scenario 4.
Have you checked the sk100583 - Troubleshooting "SmartCenter behind NAT" issues?
If not, look at the Scenario 4.
Hello Andrey,
this is a very common issue, you have done everything correctly.
In order to have your local firewalls to talk to your management server on its local IP address (10.1.0.100), simply replace the external IP with the local one of your management within the $FWDIR/conf/masters
file of each affected gateway (sk40090) and prevent it from being overwritten on policy install (sk102712). That's it.
Hi,
Thank you for the solution as I did as the SK asked and the gateways are able to send from the internal interfaces.
But the thing is it is still trying to communicate with the external interfaces as in means on there is 2 connection from each gateway one from the internal ( as established) , still one from the external (syn_recv) on the netstat table.
I tried to cpstop/cpstart but didn't disappear and it is continuously sending the traffic from both interfaces as this is causing to log locally.
Couldn't see any details on the SK's , has anyone had this issue?
Thank you
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY