Basically, your logs say "you can't legally route packets between two
interfaces marked as external". Checkpoint allows definition of more than
one external interface, BUT blocks routing between them to avoid license
violations (FW-1 doesn't count hosts "seen" by external interfaces towards
license count)
To solve your issue, you should mark as non-external the interface you're
using for the VPN to your Cisco (the VPN isn't across the Internet, is it?),
thus your firewall won't be locked in routing.
Hope this helps
NA
----- Original Message -----
From: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, March 09, 2004 10:29 AM
Subject: [FW-1] VPN tunnel: *message_info: Dropped packet forwarded between
two external interfaces*
> i've got a strange problem on IPSEC tunnel between cisco 1700 and fw-1
R55:
>
> lanB
> |
> routerB cisco 1700
> |
> |
> |
> tunnel VPN
> |
> |
> |
> fwA nokia fw-1 R55 ---------internet
> |
> lanA
>
> the tunnel is working fine, if a user from lan B goes to lan A is fine.
> if a user from lan B goes to Internet trough a proxy in lan A is fine
>
> is a user from lan B wants to go to INternet directly, using first the VPN
> tunnel to HQ and then the internet connection, fw-1 says:
>
> *message_info: Dropped packet forwarded between two external interfaces*
>
>
> there is something about "NAT on client side configuration" ?
>
> anybody has a similar configuration ?
>
> thnkx in advance, alberto
>
> __________________________________________________________________
> Tiscali ADSL SENZA CANONE:
> Attivazione GRATIS, contributo adesione GRATIS, modem GRATIS,
> 50 ore di navigazione GRATIS. ABBONARTI TI COSTA SOLO UN CLICK!
> http://point.tiscali.it/adsl/index.shtml
>
> =================================================
> To set vacation, Out-Of-Office, or away messages,
> send an email to [EMAIL PROTECTED]
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> If you have any questions on how to change your
> subscription options, email
> [EMAIL PROTECTED]
> =================================================
>
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
