Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
kenn2000
Participant

Configure Public IP address directly on a server behind Checkpoint

Jump to solution

Hi Everyone,

We are in process of implementing Mitel MiCollab and the requirement is the WAN interface of the Micollab server should have public ip assigned directly on it. NATting from public ip to private ip does not support.

The MiCollab server is a VM behind the Checkpoint.

How could I achieve this setup with Checkpoint?

Thank you.

0 Kudos
1 Solution

Accepted Solutions
Bob_Zimmerman
Advisor

@Chris_Atkinson wrote:

Having public address on only the external interface cannot achieve this if the objective is not to use NAT.


Sure you can. It's really easy.

  1. Pick a new network which will contain the MiCollab box. It can be private, and should be at least a /30 for a single firewall or a /29 for a two-member cluster.
  2. Assign an IP in this network for the firewall. If using a cluster, also assign an IP for each member.
  3. Assign the public IP to the MiCollab box.
  4. Set the MiCollab box's default route to the private IP on the firewall's interface.
  5. Add a 32-bit interface route pointing the public address out the firewall's interface connected to the network with the MiCollab box. The command to add this route will look like this:
set static-route 1.2.3.4/32 nexthop gateway logical eth1.2345 on

 

Due to a complicated set of requirements, I have a firewall which works like this in my environment. It's a bit weird to get used to, but pretty solid.

View solution in original post

8 Replies
_Val_
Admin
Admin

setup a DMZ

0 Kudos
Chris_Atkinson
Employee
Employee

As Val has hinted another interface/VLAN from the Check Point addressed with the public subnet and configuration pertinent for a DMZ.

0 Kudos
kenn2000
Participant

Thank you all for your comments.

Sorry I am new to Checkpoint so needing your help further.

We currently have DMZ with a different subnet.

All public IPs have been forwarded to External on a bond Interface.

So I don't know how another DMZ network/Interface will work as what would be the IP address/subnet for them?. What I am understanding is each Interface should have a different subnet.

Could you please help explaining further?

Thank you very much.

0 Kudos
Chris_Atkinson
Employee
Employee

Having public address on only the external interface cannot achieve this if the objective is not to use NAT.

The vendor of Firewall doesn't matter in this context.

 

Does the existing DMZ have/use public addresses (Y/N)?

Yes - Connect the Mitel here with an IP from that subnet.

No - You will likely have to create a new DMZ involving networking/routing changes & possibly requesting extra or new IP addresses from your ISP.

0 Kudos
Bob_Zimmerman
Advisor

@Chris_Atkinson wrote:

Having public address on only the external interface cannot achieve this if the objective is not to use NAT.


Sure you can. It's really easy.

  1. Pick a new network which will contain the MiCollab box. It can be private, and should be at least a /30 for a single firewall or a /29 for a two-member cluster.
  2. Assign an IP in this network for the firewall. If using a cluster, also assign an IP for each member.
  3. Assign the public IP to the MiCollab box.
  4. Set the MiCollab box's default route to the private IP on the firewall's interface.
  5. Add a 32-bit interface route pointing the public address out the firewall's interface connected to the network with the MiCollab box. The command to add this route will look like this:
set static-route 1.2.3.4/32 nexthop gateway logical eth1.2345 on

 

Due to a complicated set of requirements, I have a firewall which works like this in my environment. It's a bit weird to get used to, but pretty solid.

Chris_Atkinson
Employee
Employee

Thanks Bob, I was making an assumption from what was said that routing changes were out of scope or not possible due to the size of the existing external subnet.

0 Kudos
Vladimir
Champion
Champion

Depending on the size of your public IP network, this could be accomplished by breaking it into smaller subnets.

Create DMZ using one of the small subnets with public IPs and place your Mitel unit in it.

You will have to configure static routes on the ISP router to forward traffic destined to individual subnets to use Check Point's external IP as the gateway.

0 Kudos
kenn2000
Participant

Thank you @Bob_Zimmerman , @Chris_Atkinson and everyone for tipping the idea.

I now understand how it can be done. It is more complicated that I first thought where it could be just simply a special config in Checkpoint to bridge the traffic directly to Micollab in DMZ.

Will need to involve more parties into the solution.

Much appreciated.

 

0 Kudos