Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
A_KOUADIO
Contributor

The packets from a source to a destination in one path and takes a different path when it returns

When i initiate a trafic is drop or match another rule, so i need to create another rule for the return trafic.

explain.png

 See the screenshot

0 Kudos
17 Replies
Chris_Atkinson
Employee Employee
Employee

Have you confirmed the routing is correct end-to-end and that anti-spoofing is set correctly?

Is there any NAT involved and could you please share a better/clearer screenshot?

CCSM R77/R80/ELITE
0 Kudos
A_KOUADIO
Contributor

Routing is correct.

antispoofing is set correctly.

I will check the NAT.

Do you think that it is normal (correct) to have return trafic as new entry in log without nat the trafic ?

0 Kudos
Chris_Atkinson
Employee Employee
Employee

This screenshot appears different to the original, can you provide the more detailed log cards for both flows?

There is some suggestion here that's proxy is involved, are only some ports/redirected to the proxy and others NAT different?

CCSM R77/R80/ELITE
0 Kudos
A_KOUADIO
Contributor

I didn't understand your message but the client has a proxy in his intranet.

0 Kudos
the_rock
Legend
Legend

I would agree totally with what Chris said. 99% of the time, its either NAT, routing or anti-spoofing (or combination of all of them).

0 Kudos
A_KOUADIO
Contributor

Ok I will check the cpinfo file today to verify?

0 Kudos
G_W_Albrecht
Legend
Legend

What will you check how in cpinfo ?

CCSE CCTE CCSM SMB Specialist
0 Kudos
A_KOUADIO
Contributor

As i said, I am currently looking for the cause of the asymmetric routing

 

0 Kudos
G_W_Albrecht
Legend
Legend

But how to accomplish this in cpinfo ? Never heard of routing issues resolved by cpinfo analysis...

CCSE CCTE CCSM SMB Specialist
A_KOUADIO
Contributor

I don't have access to the appliance, so i will analyze on my side the cpinfo file and after that i will contact the customer to have clear understanding of the issues.

0 Kudos
_Val_
Admin
Admin

I do not think you will find all answers in the CPInfo. In most cases, asymmetric routing is caused by external factors. 

0 Kudos
G_W_Albrecht
Legend
Legend

Great - which tool are you using ? Or do you search in the cpinfo text ?

CCSE CCTE CCSM SMB Specialist
0 Kudos
A_KOUADIO
Contributor

CheckPoint Diagnostics View

0 Kudos
the_rock
Legend
Legend

Hey @A_KOUADIO ,

I think what @_Val_ and @G_W_Albrecht are saying is that its very unlikely you would find an answer as to why assymetric routing happens from cpinfo file review, as thats simply the config file from the firewall. Here is what I would run and examine carefully the output. So, just as an example, say the source is 10.10.10.10 and dst is 20.20.20.20, try commands like below:

fw monitor -e "accept host(10.10.10.10) and dst(20.20.20.20);"

fw monitor -e "accept host(20.20.20.20) and dst(10.10.10.10);"

fw minitor -e "accept host(10.10.10.10) or dst(20.20.20.20);"

Alternatively, you can also use below command. Idea is to filter for src IP, src port, dst IP, dst IP, protocol

fw monitor -F "10.10.10.10,0,20.20.20.20,0,0" -F "20.20.20.20,0,10.10.10.10,0,0"

I can also suggest a website my colleague made ages ago to help people with captures on different platforms (its very useful)

https://tcpdump101.com/#

Hope all this helps you.

Cheers,

Andy

G_W_Albrecht
Legend
Legend

Dropped by Access Rule Number 1225 ???

CCSE CCTE CCSM SMB Specialist
0 Kudos
A_KOUADIO
Contributor

Because the source port match another rule.

As I said previously, the return traffic is dissociated from the going trafic so it match another rule or drop by the cleanup rule.

0 Kudos
G_W_Albrecht
Legend
Legend

I would not use 1225 rules - but that should not cause asymmetrical routing afaik...

CCSE CCTE CCSM SMB Specialist
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events