Raghu, 1. It's not an optimal solution. Static routes would be best. But it is possible. I have setup firewalls utilizing ospf when we needed that (a firewall between internal networks). 2. If you need to propagate routes between routers on the inside and outside you should rather try to unicast this through the firewall using eigrp. 3. If you run additional services on the firewall there's an increased chance you are vulnerable. routed has had remote holes in the past and might have again (or it may not; you never know).
Just my EUR0.02 Lars > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Sent: Tuesday, March 11, 2003 22:24 > To: [EMAIL PROTECTED] > Subject: [FW-1] routed on firewall > > > Hi Group, > > We have a Checkpoint firewall running on a Solaris 2.6 box. We have a > requirement to let our internal networks learn the RIP (v2) > routes learned > by the routers outside the firewall. We are planning to run > routed provided > by Solaris to learn the RIP routes from the outside interface > and propagate > them to the inside network. I have following questions: > > 1. What do you think about this solution? Is it good? > > 2. Do I have any other option other than running a routing daemon to > propagate RIP routes from the outside interface to inside > interface? (I know > Solaris 2.6 in.routed doesn't support RIP-v2, but RIP-v1 it > will do my job > with little hassle. Any suggestions about other routing > daemons are welcome) > > 3. Does it impose any security risk in running a routing daemon on a > critical system like firewall? If yes, what kind of risk you > can foresee and > can you suggest any ways to mitigate it? > > Your opinions/suggestions in this regard are very much appreciated. > > Regards, > Raghu > > > > This message is confidential and may also be legally > privileged. If you are not the intended recipient, please > notify [EMAIL PROTECTED] immediately. You should not > copy it or use it for any purpose, nor disclose its contents > to any other person. The views and opinions expressed in this > e-mail message are the author's own and may not reflect the > views and opinions of ADP Wilco. > > ================================================= > To set vacation, Out Of Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= > ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
