Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
marcinw
Participant

changing IP address on security gateway and SIC

Hi,

I need to set up CHeckpoint GW as VPN edge for remote location and I am wondering if I set up community vpn between gateway and SMS and on the day of shipping the Gateway I will change IP address of WAN GW interface do I have to reestablish SIC or everything will be working out of the box ?

0 Kudos
6 Replies
vinceneil666
Advisor

SIC operates on certificates, so you should be fine.

0 Kudos
Bob_Zimmerman
Advisor

While this is true, the mention of VPNs concerns me a little. Traffic between the management server and the firewall cannot go over a VPN. The firewall needs to talk to the management server to bring a VPN up, and if the VPN needs to be up to talk to the management, it won't be able to.

0 Kudos
G_W_Albrecht
Legend
Legend

With VPN you have traffic between two GWs, not the SMS - so if VPN Domain is defined correctly, it will work.

0 Kudos
Bob_Zimmerman
Advisor

Except the firewall has to fetch the CRL from the management. If that fails, the VPN won't come up. Thus, the remote firewall must be able to talk to the management server without the VPN.

0 Kudos
G_W_Albrecht
Legend
Legend

You will have to change the GW IP in Dashboard, of course...

0 Kudos
Timothy_Hall
Champion
Champion

SIC does indeed operate with certificates and cares not about the IP addresses involved, BUT there is an implied rule on the firewall that allows only the known IP address of the SMS to talk to the known IP addresses of the firewall for management traffic such as SIC and policy installs.  If you change any elements of this you may run afoul of this implied rule, and be forced to perform a fw unloadlocal on the firewall for SIC to start working after an IP change. 

To avoid this, create an temporary explicit rule at the top of your rulebase ahead of time and install it to the gateway *prior* to the WAN IP change:

Src: SMS (and/or SMS NAT address)

Dst: Any

Service: Any

Action: Accept

Once the WAN IP change is made and you successfully install policy to the gateway under the new config, the implied rule will be updated (assuming you correctly changed the firewall's WAN address on the firewall/cluster object) and this temporary explicit rule can be removed.

"Max Capture: Know Your Packets" Video Series
now available at http://www.maxpowerfirewalls.com
0 Kudos