Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
kenn2000
Participant
Jump to solution

Configure Public IP address directly on a server behind Checkpoint

Hi Everyone,

We are in process of implementing Mitel MiCollab and the requirement is the WAN interface of the Micollab server should have public ip assigned directly on it. NATting from public ip to private ip does not support.

The MiCollab server is a VM behind the Checkpoint.

How could I achieve this setup with Checkpoint?

Thank you.

0 Kudos
1 Solution

Accepted Solutions
Bob_Zimmerman
Mentor
Mentor

@Chris_Atkinson wrote:

Having public address on only the external interface cannot achieve this if the objective is not to use NAT.


Sure you can. It's really easy.

  1. Pick a new network which will contain the MiCollab box. It can be private, and should be at least a /30 for a single firewall or a /29 for a two-member cluster.
  2. Assign an IP in this network for the firewall. If using a cluster, also assign an IP for each member.
  3. Assign the public IP to the MiCollab box.
  4. Set the MiCollab box's default route to the private IP on the firewall's interface.
  5. Add a 32-bit interface route pointing the public address out the firewall's interface connected to the network with the MiCollab box. The command to add this route will look like this:
set static-route 1.2.3.4/32 nexthop gateway logical eth1.2345 on

 

Due to a complicated set of requirements, I have a firewall which works like this in my environment. It's a bit weird to get used to, but pretty solid.

View solution in original post

12 Replies
_Val_
Admin
Admin

setup a DMZ

0 Kudos
Chris_Atkinson
Employee Employee
Employee

As Val has hinted another interface/VLAN from the Check Point addressed with the public subnet and configuration pertinent for a DMZ.

CCSM R77/R80/ELITE
0 Kudos
kenn2000
Participant

Thank you all for your comments.

Sorry I am new to Checkpoint so needing your help further.

We currently have DMZ with a different subnet.

All public IPs have been forwarded to External on a bond Interface.

So I don't know how another DMZ network/Interface will work as what would be the IP address/subnet for them?. What I am understanding is each Interface should have a different subnet.

Could you please help explaining further?

Thank you very much.

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Having public address on only the external interface cannot achieve this if the objective is not to use NAT.

The vendor of Firewall doesn't matter in this context.

 

Does the existing DMZ have/use public addresses (Y/N)?

Yes - Connect the Mitel here with an IP from that subnet.

No - You will likely have to create a new DMZ involving networking/routing changes & possibly requesting extra or new IP addresses from your ISP.

CCSM R77/R80/ELITE
0 Kudos
Bob_Zimmerman
Mentor
Mentor

@Chris_Atkinson wrote:

Having public address on only the external interface cannot achieve this if the objective is not to use NAT.


Sure you can. It's really easy.

  1. Pick a new network which will contain the MiCollab box. It can be private, and should be at least a /30 for a single firewall or a /29 for a two-member cluster.
  2. Assign an IP in this network for the firewall. If using a cluster, also assign an IP for each member.
  3. Assign the public IP to the MiCollab box.
  4. Set the MiCollab box's default route to the private IP on the firewall's interface.
  5. Add a 32-bit interface route pointing the public address out the firewall's interface connected to the network with the MiCollab box. The command to add this route will look like this:
set static-route 1.2.3.4/32 nexthop gateway logical eth1.2345 on

 

Due to a complicated set of requirements, I have a firewall which works like this in my environment. It's a bit weird to get used to, but pretty solid.

Chris_Atkinson
Employee Employee
Employee

Thanks Bob, I was making an assumption from what was said that routing changes were out of scope or not possible due to the size of the existing external subnet.

CCSM R77/R80/ELITE
0 Kudos
blacx_13
Explorer

Hi Bob,

I'm fairly new with checkpoint, i just have few clarifications with this solution. let me know if my assumptions are correct.

4. I am using a layer 2 switch on the DMZ, would this solution still work

5. Im a bit confused on the command will it be something like this based on the diagram
 

set static-route 1.1.1.2/32 nexthop gateway logical eth.xx (WAN) on

cp.png

 

0 Kudos
Bob_Zimmerman
Mentor
Mentor

4. Yes, you would need to use a switch. Having a router in the path makes things a bit more complicated, but still possible.

5. You don't have interface names on that diagram, but it would be 'set static-route 1.1.1.2/32 nexthop gateway logical <interface leading to the switch labeled DMZ> on'. You would then need to set the default route on 1.1.1.2 to be the cluster VIP on that interface. You should not use a public IP for that VIP.

(1)
blacx_13
Explorer

btw, this is not a part of a cluster. so it would be something like this ? since I dont have any VIP
 'set static-route 1.1.1.2/32 nexthop gateway eth3 (20.20.20.1 interface) on'

0 Kudos
Bob_Zimmerman
Mentor
Mentor

set static-route 1.1.1.2/32 nexthop gateway logical eth3 on

And remember, you need to set the endpoint's default route to the firewall's address on eth3. You may also need to give the endpoint a route to the firewall's address telling it to go out a particular interface. The right way to set all that up depends on the OS on the endpoint.

0 Kudos
Vladimir
Champion
Champion

Depending on the size of your public IP network, this could be accomplished by breaking it into smaller subnets.

Create DMZ using one of the small subnets with public IPs and place your Mitel unit in it.

You will have to configure static routes on the ISP router to forward traffic destined to individual subnets to use Check Point's external IP as the gateway.

0 Kudos
kenn2000
Participant

Thank you @Bob_Zimmerman , @Chris_Atkinson and everyone for tipping the idea.

I now understand how it can be done. It is more complicated that I first thought where it could be just simply a special config in Checkpoint to bridge the traffic directly to Micollab in DMZ.

Will need to involve more parties into the solution.

Much appreciated.

 

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events