cancel
Showing results for 
Search instead for 
Did you mean: 
Post a Question

Redirect NTP?

Jump to solution

We are migrating our networks to Checkpoint and have about 60 VLANs where various devices ask the default GW for NTP. Ths wasn't a problem before, but since checkpoint can't work as an NTP server I thought we could just redirect the traffic to the def GW to our NTP server. 

This was harder than expected though. Smiley Happy

I don't have any experience with NAT on checkpoint since we don't use it on this site, but it sounded simple in my head. I don't really understand how it's supposed to be done in checkpoint though.

I tried:

NAT, Original: (src: <VLAN> dst:<def GW> service:NTP ) Translated: ( dst:<NTP server>, rest original)

and FW Policy allowing NTP traffic to def GW.

The VLAN itself is already allowed to communicate with the NTP server in an earlier policy, since on some devices in the VLAN it is easy to fix the NTP settings.

But the traffic is still dropped. Do i need to add a host-object with NAT checked and the translated address for every VLAN as well?

Or isn't this possible at all?

1 Solution

Accepted Solutions
Michal_Gans
Nickel

Re: Redirect NTP?

Jump to solution

From mine point of view the proper way is to use new group (all networks in requested VLANs) and dst fw_node/fw_cluster object. Also check if rule which allowing ntp to fw is above stealth rule.

7 Replies
Michal_Gans
Nickel

Re: Redirect NTP?

Jump to solution

What types of objects you used in "src: <VLAN>" (group/network...) and "dst:<def GW>" (host/fw_cluster/fw_node)?

0 Kudos

Re: Redirect NTP?

Jump to solution

the VLAN:s are network objects. I made a new host-object with the default-GW address. 

0 Kudos

Re: Redirect NTP?

Jump to solution

There is an unsupported way to get the Check Point GAIA software to runn as a NTP server:

vi the /etc/ntp.conf file and add the following line per network you want to allow to get NTP from the gateway:

restrict 10.0.0.0 mask 255.0.0.0 nomodify

Above is allowing any 10.x.x.x client to get NTP from the gateway.

Regards, Maarten
0 Kudos

Re: Redirect NTP?

Jump to solution

we run R80.10 and as I understood it, this won't work anymore? the ntp.conf is automatically generated, but maybe it won't get overwritten unless you change the ntp settings?

since it's a normal linux system as base, it would be possible to use ntpd for our networks. But there was an SK about this being prevented. 

0 Kudos
Michal_Gans
Nickel

Re: Redirect NTP?

Jump to solution

From mine point of view the proper way is to use new group (all networks in requested VLANs) and dst fw_node/fw_cluster object. Also check if rule which allowing ntp to fw is above stealth rule.

Re: Redirect NTP?

Jump to solution

hmm, I can't use the FW cluster in the NAT rule. Can't install the policy when I try to do that. That's why i made a host-object for the default GW. 

But I forgot about the stealth rules. I can move the access policy and see if it makes a difference.

0 Kudos
Highlighted

Re: Redirect NTP?

Jump to solution

that was it, the stealth rule. Didn't think about it since all the drops were registered with CPEarlyDrop. It worked to make a NAT redirect as I thought then.