> -----Original Message----- > From: Crist Clark [mailto:[EMAIL PROTECTED]
> >> fw monitor output gives: > >> eth3:i[44]: 172.27.x.x -> x.x.x.x (TCP) len=44 id=769 > >> eth3:I[44]: 172.27.x.x -> x.x.x.x (TCP) len=44 id=769 > >> > >> x.x.x.x is our official ip-address. > > It looks like this is getting through the FW-1 processing on the > input side. There are no "eth2:o" entries? It would look like the > packets never get sent to FW-1 on the output side. I'm not sure > what would be higher up the stack in the system that would really > care about the source address. Routing black holes and the like > wouldn't care about the source address. Exactly. I don't see any "eth2:o" entries. IP, TCP and Application is higher in the system so it would seem that it is dropped somewhere there. And ofcourse routing is, but routing is correct. I've even tried to route the destination address to one of the other internal interfaces just to make sure, and I didn't see any traffic there either. It just won't get to the output side of FW-1. > No. We have Check Point firewalls with RFC1918 address ranges on > the "external" side and have never had any problems. There really > is nothing special about RFC1918 addresses accept for the fact that > they will never be assigned to an organization as globally unique IP > addresses. They should not be treated by software in any special > fashion. Ok. Thanks for clearing this up. Then I don't have to worry about that. Regards, Torkel ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
