Michel,
I assume the that the network topology defined for interface eth2 is the networks 2.3.4.0/24 & 3.4.5.0/24 ( as being behind the interface).
If that is the case you can create a group with exceptions to define the networks behind eth2 like so:
Create net objects: 2.3.4.0/24 & 3.4.5.0/24
Create host object: 2.3.4.50/32
Create group object: PartnerNet { 2.3.4.0/24, 3.4.5.0/24 }
Create group object: PartneHost { 2.3.4.50/32 }
Create group w/exceptions object: PartnerNet-Valid {PartnerNet {except
PartnerHost} }Hope this helps.
Regards,
___________________ John Ruff [EMAIL PROTECTED]
"No one can see past a choice they don't understand." --Oracle
Automatic digest processor wrote:
Hello,
I have a weird problem which force me to disable anti-spoofing on the external interface and I would like to know if anybody know why this happen and if there is a way to fix it...
The current setup is the following.
Eth 0 -> Lead to the internet
Eth 1 -> Lead to internal network
Eth 2 -> Lead to partner network
The only Natting that occur is when a packet need to be routed out of Eth0 (Internet)
Topology is
Eth 0 -> External
Eth 1 -> This Network
Eth 2 -> Partner Network
Partner Network:
2.3.4.0/24
3.4.5.0/24
...
Routing on the FW is:
0.0.0.0/0 -> Internet
2.3.4.0/24 -> Eth2
3.4.5.0/24 -> Eth2
2.3.4.50/32 -> Internet
Routing wise everything work fine.
NAT Rule
Eth1 2.3.4.50/32 Eth0.2 (Hide) DESTINATION
Eth1/Eth2 ANY SOURCE DESTINATION
Eth1/Eth2 ANY Eth0.1 (Hide) DESITNATION
If from the Internal Network (Eth1) I send a packet
Eth1 -> Inet Address except Partner Network -> Got NATTED -> Work Fine
Eth1 -> Partner Network -> No NAT -> Work Fine
Eth1 -> 2.3.4.50 -> Got NATTED -> Doesn't Work, the Eth0 interface complaint that it get spoofed by the NAT address which is on the same network as the Eth0 interface
If I remove the anti-spoofing on Eth0, everything work fine...
So does anyone know why when trying to route a subset of a subnet through a different interface the NATTING won't work
Also if I disable Anti-Spoofing except on the Eth0 , or/and set all network to External, it will have the same problem.
If you have any idea suggestion it will be appreciated.
Thank
Michel Lapointe
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
