Hi All, I am very new to Check Point, my lab setting as given below, here the problem is that, I am unable to ping the gateway inside vm from GNS3, I tried disabling all the windows firewall / anti virus /windows defender inside & out side vm.
I can ping only when i make changes in the global properties , "Accept ICMP request" to "FIRST". Could anyone please check the and help?..
My Lab Set-Up
SC –> 10.111.0.5
Mgmt Server – >10.111.0.4
Gateway1 inside (VmNet1)-> 10.111.0.1
Gateway1 outside (VmNet8)-> 172.168.1.2/30
Laptop IP 192.168.1.5
VmNet1 adaptor – 10.111.0.10
VmNet8 adaptor-172.168.1.11
VmWare External & Internal connections
Ping from Admin PC inside VM
Ping from Gateway (10.111.0.1) to SC, Remote PC in GNS3, To vmnet1 & vmnet8 adaptor for Laptop
Policies Applied
Smart View Tracker
Can ping from inside to outside but not able to ping from outside (Remote_PC_GNS3) to inside
Logs below
Inside to outside – ICMP Allowed – Rule 3 - TESTING
Blocked – From outside to inside – Rule 2, Stealth
Configuration in GNS3.
!
interface FastEthernet0/0
ip address 172.168.1.1 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
ip forward-protocol nd
ip route 10.111.0.0 255.255.255.0 172.168.1.2
ip route 172.168.1.0 255.255.255.0 172.168.1.2
!
PING form Router
Cisco3725#ping 172.168.1.1 (self)
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
Cisco3725#ping 172.168.1.11 (Laptop)
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.168.1.11, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/8/12 ms
Cisco3725#ping 172.168.1.2 (Gateway outside)
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.168.1.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
Ping to inside through 172.168.1.2 is blocked L
Cisco3725#ping 10.111.0.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.111.0.5, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
Cisco3725#ping 10.111.0.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.111.0.4, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
Cisco3725#ping 10.111.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.111.0.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
Windows FW & Antivirus disabled.
------------------
ARP from router
Cisco3725#sh arp fast
Cisco3725#sh arp fastEthernet 0/0
Protocol Address Age (min) Hardware Addr Type Interface
Internet 172.168.1.1 - c201.24a4.0000 ARPA FastEthernet0/0
Internet 172.168.1.11 15 0050.56c0.0008 ARPA FastEthernet0/0
Internet 172.168.1.2 33 000c.29ac.0779 ARPA FastEthernet0/0
Cisco3725#
Cisco3725#
Cisco3725#
Cisco3725#ping 172.168.1.2
Debug report from firewall..
kiss_debug_report: start
;[fw4_0];FW-1: Initializing debugging buffer to size 1023K;
;[fw4_0];Setting the flags for debug module fw: drop;
;[fw4_0];fw_log_drop_ex: Packet proto=1 172.168.1.1:2048 -> 172.168.1.2:36473 dropped by fw_handle_first_packet Reason: Rulebase drop - rule 2;
;[fw4_0];fw_log_drop_ex: Packet proto=1 172.168.1.1:2048 -> 172.168.1.2:34472 dropped by fw_handle_first_packet Reason: Rulebase drop - rule 2;
;[fw4_0];fw_log_drop_ex: Packet proto=1 172.168.1.1:2048 -> 172.168.1.2:32471 dropped by fw_handle_first_packet Reason: Rulebase drop - rule 2;
;[fw4_0];fw_log_drop_ex: Packet proto=1 172.168.1.1:2048 -> 172.168.1.2:30470 dropped by fw_handle_first_packet Reason: Rulebase drop - rule 2;
;[fw4_0];fw_log_drop_ex: Packet proto=1 172.168.1.1:2048 -> 172.168.1.2:28469 dropped by fw_handle_first_packet Reason: Rulebase drop - rule 2;
Defaulting all kernel debugging options
Gateway1-04-04-2020> show interface eth1
state on
mac-addr 00:0c:29:ac:07:79
type ethernet
link-state link up
mtu 1500
auto-negotiation on
speed 1000M
ipv6-autoconfig Not configured
duplex full
monitor-mode off
link-speed 1000M/full
comments VmNet8_GNS3/Laptop
ipv4-address 172.168.1.2/24
ipv6-address Not Configured
ipv6-local-link-address Not Configured
Statistics:
TX bytes:464 packets:8 errors:0 dropped:0 overruns:0 carrier:0