I'm about to make some routing changes and I fear I may have to do some
very ugly things to get this to work. I'm looking for a way to do this
elegantly.
I have a NG AI firewall. It routes a publicly registered address block to
the inside. Let's call it, 1.1.1.0/24, in this example. Now, I want
to take one, yes, one, host from this block and route the traffic for
it out to the Internet. Let's say, 1.1.1.20. Before anyone asks, I have
a good reason to do this[0].
How do I handle the Topology for this? The problem is that I would like
to specify 1.1.1.0/24 as living off of the internal interface, up add
that 1.1.1.20 is on the external interface... But I can't do that. The
external interface is "External" and I cannot add that 1.1.1.20 lives
out there too and not with the rest of 1.1.1.0/24 on the inside. Or can
I?
Now, the ugly brute force way to do this is not to specify 1.1.1.0/24
as being internal and 1.1.1.20 as external, but rather specify,
1.1.1.0/28
1.1.1.16/30
1.1.1.21/32
1.1.1.22/31
1.1.1.24/29
1.1.1.32/27
1.1.1.64/26
1.1.1.128/25
As being internal, and the exclusion of 1.1.1.20 makes it external
by default. But that just seems so... so... so, wrong.
[0] My reason is that the 1.1.1.0/24 network is actually a separate
location which has its own Internet connection. Ususally, 1.1.1.0/24
is routed across a private leased line to the other site. However,
if that link fails, we want to have a Internet VPN backup to the other
site. The 1.1.1.20 is the gateway for this backup VPN at the other
site.
--
Crist J. Clark [EMAIL PROTECTED]
Globalstar Communications (408) 933-4387
The information contained in this e-mail message is confidential,
intended only for the use of the individual or entity named above.
If the reader of this e-mail is not the intended recipient, or the
employee or agent responsible to deliver it to the intended recipient,
you are hereby notified that any review, dissemination, distribution or
copying of this communication is strictly prohibited. If you have
received this e-mail in error, please contact [EMAIL PROTECTED]
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
