> We have a Checkpoint firewall running on a Solaris 2.6 box. We have a > requirement to let our internal networks learn the RIP (v2) > routes learned > by the routers outside the firewall. We are planning to run > routed provided > by Solaris to learn the RIP routes from the outside interface > and propagate > them to the inside network. I have following questions:
I have a question: Why do you want to do this? Do you have multiple routes to remotes sites so that you have a need for a routing protocol internally? You say "a" Checkpoint firewall. If you have just one, I don't see how you need rip. Your firewall will be the default route for your internal clients. Set the default route on your firewall to point at your external gateway router. That is where you want your rip. It typically is not considered "best practice" to run a routing protocol on your fw, although I am not familiar with any known exploits. Hal > > 1. What do you think about this solution? Is it good? > > 2. Do I have any other option other than running a routing daemon to > propagate RIP routes from the outside interface to inside > interface? (I know > Solaris 2.6 in.routed doesn't support RIP-v2, but RIP-v1 it > will do my job > with little hassle. Any suggestions about other routing > daemons are welcome) > > 3. Does it impose any security risk in running a routing daemon on a > critical system like firewall? If yes, what kind of risk you > can foresee and > can you suggest any ways to mitigate it? > > Your opinions/suggestions in this regard are very much appreciated. > > Regards, > Raghu > > ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
