Check Point 1450 Appliance Several External IP

[vitaliyb]

Hi, all.

I am a newbie with Check Point products.

I have Check Point 1450 in my company. ISP bring us a network with /29 mask.

Now I can assign only one IP to External interface.

How can I let to work another 4 IP's?  

[PhoneBoy]

What is the configuration of the WAN interface?
Is this 1450 centrally managed or locally managed?

[vitaliyb]

1450 localy managed.

[PhoneBoy]

Few ways to do it:

• Put the relevant hosts on the WAN side of the firewall and assign them one of your four remaining IPs. Obviously the 1450 won't be protecting these hosts.
• Create Server objects (Users and Objects > Servers) for the hosts you want to use the public IP addresses. In Step 2 of the Wizard, you specify the private IP address of the system in question. In Step 4, you specify the public IP you want the system to be accessible by.
• Create manual NAT rules (Access Policy > Firewall > NAT).

[vitaliyb]

Thanks for reply.

I think I have not accurately explained what I want to get in the end. 

By now all works fine, but with only one IP.

Look at pic.

Ideally Server1 must be publish by IP1.  Server2 by IP2 & etc. 

Is it real? 

[G_W_Albrecht]

PhoneBoy has already answered your question - define Server Objects:

Step 2Step 1

Step3

Step 4

[vitaliyb]

Thanks, but it didn't work for me.

I do all like you say, but in Logs nothing that refer to Second IP. 

Look at pic. Blue rule work fine. Red rule don't.

[PhoneBoy]

If you do a tcpdump on the WAN interface when someone tries connecting to the .75 address, what do you see?

[vitaliyb]

Packet Capture show nothing with IP .75

I try ping, telnet to port 5555. no mention of the address .75

[vitaliyb]

Hi, all.

Yesterday I was try localize problem.

I build this scheme. Results was:

1. IP .75 reply to ping 

2. all rules works fine. (Thanks to @G_W_Albrecht and @PhoneBoy )

But! It all works only with my laptop with IP .76

All other addresses from different subnet can't connect to IP .75

It looks like "virtual interface with IP .75" has no default-gateway on it.  

Can someone explain me whats going on?

[PhoneBoy]

What you should see on a tcpdump from the gateway when someone tries to connect to .75 is an ARP request that looks something like this:

16:09:32.652969 ARP, Request who-has x.y.z.75 tell x.y.z.73, length 28

The fact it's working from your PC connected at .76 suggests the gateway is doing exactly what it's supposed to do.
The fact it doesn't work in other scenarios suggests a configuration issue with your ISP router.

[vitaliyb]

Hi for all.
Problem was solved by changed provider's "last mile" equipment.
I try to solve problem with Checkpoint Support Team. Let him to connect to my 1450. No changes.
Finally we decided to change the type of connection to the provider and problem was gone.
Thanx for all who try to help me.