- Products
- Learn
- Local User Groups
- Partners
- More
Check Point Jump-Start Online Training
Now Available on CheckMates for Beginners!
Why do Hackers Love IoT Devices so Much?
Join our TechTalk on Aug 17, at 5PM CET | 11AM EST
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
ZTNA Buyer’s Guide
Zero Trust essentials for your most valuable assets
The SMB Cyber Master
Boost your knowledge on Quantum Spark SMB gateways!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
Hi Team ,
Can someone explain me how to configure Proxy Arp for Static NAT Public IP on R80.10 VSX Cluster firewall .My Cluster is active passive mode .I am go through SK30197 but not understand .
Nilesh,
ther's another way to add a proxy arp entry to a gateway without configuring via the GAiA portal or close.
Add a host object with your external IP to your rulebase and configure automatic NAT (static). As NAT-IP use the same external IP, add the relevant gateway and do a policy install. With this host object the gateway adds an proxy arp entry to the the gateway.
Wolfgang
Nilesh,
ther's another way to add a proxy arp entry to a gateway without configuring via the GAiA portal or close.
Add a host object with your external IP to your rulebase and configure automatic NAT (static). As NAT-IP use the same external IP, add the relevant gateway and do a policy install. With this host object the gateway adds an proxy arp entry to the the gateway.
Wolfgang
I am virtualizing a HA Cluster to a VSX Cluster and have been reading some documentation regarding PROXY ARP and VSX . One thing I would like to discuss is the relation between a proxy arp entry in clish and the local.arp file. I have to understand this better so that I can configure this in the new VSX enviroment.
This is taken from a normal HA cluster not a VSX!
local.arp - 193.45.59.11 00:1c:7f:63:e8:76 193.45.95.20
--------------------------------------------------------------------------------------------------
clish - add arp proxy ipv4-address 193.45.59.11 interface bond1 real-ipv4-address 193.45.95.20
If I have understood this post correctly I only have to add proxy arp on the vs and nothing in the local.arp file?
Sincerely
Clive Overton-Fox
I tried this and it did not work, I ended up creating a local.arp file on the VS, I used SK30197 as reference. This was done on a R80.40 VSX cluster.
With VSX, you must use clish to configure proxy ARP entries for VS0 (this isn't common, but it is technically possible), and you must use local.arp for proxy ARP entries for any VS other than 0.
Thanks Bob - I confirmed this with TAC today as well, I think Checkpoint should improve on this so that clish commands for proxy arp entries should also work on specific VS's (the commands are accepted).
I'm the other way around. I can't stand clish, and would love to go back to local.arp for all proxy ARP entries on all VSs and on non-VSX firewalls.
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY