Anyone Familiar with Checkpoint Firewall 1 V4.1?
19 August 2001, 11:50 PM
#1
Scooby Regular
Thread Starter
Join Date: Dec 2001
Posts: 291
Likes: 0
Received 0 Likes
on
0 Posts
If you have.... would you mind giving me a bit of advice.
I have come across FW1 for the first time. I have always used Cisco PIX or Watchguard but never FW1. Should be the same principle me thinks... Just different GUI and syntax.
I'm tying to transistion over to a new ISP. Therefore new ISP assigned IP address's and NAT objects.
I obtain the new FW1 licsense from checkpoint tied to the new external IP address. Change the IP address on the NIC and modify all objects which contain old external address's with new ones ie Network Objects, Host objects and ( Internal LAN use's private address's) NAT objects etc ( After copying the /conf file for backup. This is running on a Windows NT box by the way... I know.... I know )
Anyway change all the objects and the rules are still in place. Assumption is that the rules will now operate with the changes to the objects. Give the box a restart..... No Internet connectivity to /from the LAN.
Do an 'fw stop' and I can see the world outside only on the firewall ( Nothing in the internal LAN because no NAT is taking place ).
I check gateways , DNS, Installation of rules,IP forwarding on the NICS, route print on the firewall, access filters on new ISP router and I just can't figure it out.
In the end I give up and restore the /conf file and restore the old external ISP address and everything starts working again using the old ISP....
What have I missed? I thought all that was needed was to add a new licsense and modify the objects.... Have i missed something?
Appreciate it if you could help me out guys. Give me some clues to this puzzle.
Cheers
I have come across FW1 for the first time. I have always used Cisco PIX or Watchguard but never FW1. Should be the same principle me thinks... Just different GUI and syntax.
I'm tying to transistion over to a new ISP. Therefore new ISP assigned IP address's and NAT objects.
I obtain the new FW1 licsense from checkpoint tied to the new external IP address. Change the IP address on the NIC and modify all objects which contain old external address's with new ones ie Network Objects, Host objects and ( Internal LAN use's private address's) NAT objects etc ( After copying the /conf file for backup. This is running on a Windows NT box by the way... I know.... I know )
Anyway change all the objects and the rules are still in place. Assumption is that the rules will now operate with the changes to the objects. Give the box a restart..... No Internet connectivity to /from the LAN.
Do an 'fw stop' and I can see the world outside only on the firewall ( Nothing in the internal LAN because no NAT is taking place ).
I check gateways , DNS, Installation of rules,IP forwarding on the NICS, route print on the firewall, access filters on new ISP router and I just can't figure it out.
In the end I give up and restore the /conf file and restore the old external ISP address and everything starts working again using the old ISP....
What have I missed? I thought all that was needed was to add a new licsense and modify the objects.... Have i missed something?
Appreciate it if you could help me out guys. Give me some clues to this puzzle.
Cheers
20 August 2001, 07:31 AM
#2
Scooby Senior
Join Date: Oct 2000
Location: Zurich, Switzerland
Posts: 3,105
Likes: 0
Received 0 Likes
on
0 Posts
Have you edited the proxy.arp file to answer for the new NAT's on the external interface?
And updated the routing tables ('route print' from cmd prompt) telling calls to the new external nats should be routed to the internal interface?
Oh, and if you're running anti-spoof protection (you should be
), you'll need to add the new NAT's on this config too, otherwise it'll think it's a spoof.
And updated the routing tables ('route print' from cmd prompt) telling calls to the new external nats should be routed to the internal interface?
Oh, and if you're running anti-spoof protection (you should be
), you'll need to add the new NAT's on this config too, otherwise it'll think it's a spoof.
Thread
Thread Starter
Forum
Replies
Last Post
johnfelstead
ScoobyNet General
27
26 February 2001 05:48 PM
