Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Albin_Petersson
Contributor
Jump to solution

Redirect NTP?

We are migrating our networks to Checkpoint and have about 60 VLANs where various devices ask the default GW for NTP. Ths wasn't a problem before, but since checkpoint can't work as an NTP server I thought we could just redirect the traffic to the def GW to our NTP server. 

This was harder than expected though. Smiley Happy

I don't have any experience with NAT on checkpoint since we don't use it on this site, but it sounded simple in my head. I don't really understand how it's supposed to be done in checkpoint though.

I tried:

NAT, Original: (src: <VLAN> dst:<def GW> service:NTP ) Translated: ( dst:<NTP server>, rest original)

and FW Policy allowing NTP traffic to def GW.

The VLAN itself is already allowed to communicate with the NTP server in an earlier policy, since on some devices in the VLAN it is easy to fix the NTP settings.

But the traffic is still dropped. Do i need to add a host-object with NAT checked and the translated address for every VLAN as well?

Or isn't this possible at all?

1 Solution

Accepted Solutions
Michal_Gans
Contributor
Contributor

From mine point of view the proper way is to use new group (all networks in requested VLANs) and dst fw_node/fw_cluster object. Also check if rule which allowing ntp to fw is above stealth rule.

View solution in original post

7 Replies
Michal_Gans
Contributor
Contributor

What types of objects you used in "src: <VLAN>" (group/network...) and "dst:<def GW>" (host/fw_cluster/fw_node)?

0 Kudos
Albin_Petersson
Contributor

the VLAN:s are network objects. I made a new host-object with the default-GW address. 

0 Kudos
Maarten_Sjouw
Champion
Champion

There is an unsupported way to get the Check Point GAIA software to runn as a NTP server:

vi the /etc/ntp.conf file and add the following line per network you want to allow to get NTP from the gateway:

restrict 10.0.0.0 mask 255.0.0.0 nomodify

Above is allowing any 10.x.x.x client to get NTP from the gateway.

Regards, Maarten
0 Kudos
Albin_Petersson
Contributor

we run R80.10 and as I understood it, this won't work anymore? the ntp.conf is automatically generated, but maybe it won't get overwritten unless you change the ntp settings?

since it's a normal linux system as base, it would be possible to use ntpd for our networks. But there was an SK about this being prevented. 

0 Kudos
Michal_Gans
Contributor
Contributor

From mine point of view the proper way is to use new group (all networks in requested VLANs) and dst fw_node/fw_cluster object. Also check if rule which allowing ntp to fw is above stealth rule.

Albin_Petersson
Contributor

hmm, I can't use the FW cluster in the NAT rule. Can't install the policy when I try to do that. That's why i made a host-object for the default GW. 

But I forgot about the stealth rules. I can move the access policy and see if it makes a difference.

0 Kudos
Albin_Petersson
Contributor

that was it, the stealth rule. Didn't think about it since all the drops were registered with CPEarlyDrop. It worked to make a NAT redirect as I thought then.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events