Secureclient/Office Mode is the way to go but there a specifc build from Checkpoint that allows you to connect even if your local address is the same the network behind the firewall. One drawback is that you won't be able to connect to hosts on your local network while using Secureclient
On Thu, 6 Jan 2005 01:15:12 -0500, fwguru <[EMAIL PROTECTED]> wrote: > The reason that this does not work is since the packets' destination > IP are the same as an IP in the source subnet, securemote does not > encrypt and an arp request for mac address is issued, instead of > sending it to the default gateway. therefore, your packets never > reach the other side of the fence. > > secureclient's officemode will fix this easily. the remote firewall > will assign an ip address to a virtual secureclient network adapter on > the client, essentially accomplishing your workaround (manually > changing the client ip to a 172.16) dynamically, while maintaining > local subnet connectivity. > > if you are going to have many local hosts connecting to said remote > host, then you can also set up a site to site vpn, and create manual > nat rules to ensure that packets are routed instead of arp'd. the > other side would have to do the same. this is complex but doable. > > > On Wed, 5 Jan 2005 18:32:57 -0500, Ray <[EMAIL PROTECTED]> wrote: > > SecureClient's Office Mode would do it. Trying to use NAT rules to fake out > > the distant network as having a different IP space will get messy from a > > name resolution standpoint, unless you're only hitting one or two hosts. > > > > Ray > > > > >From: Robert Fowler <[EMAIL PROTECTED]> > > >Reply-To: Mailing list for discussion of Firewall-1 > > ><[email protected]> > > >To: [email protected] > > >Subject: [FW-1] secure remote host ip address same as network connecting to > > >Date: Wed, 5 Jan 2005 20:54:33 +0000 > > > > > >Hi All, > > > > > >I am trying to use secure remote from behind a > > >Checkpoint firewall. The secure remote client is > > >using a 10.1.1.1. I have enabled IKE over TCP and udp > > >encapsulation in secure remote. > > > > > >See below for network > > > > > >10.1.1.1 SR--> firewall-->WWW<-- firewall <-- 10.1.1.X > > >Network user wants to connect with > > > > > >when I have noticed is that if I change to secure > > >Remote (SR) clients IP address to a 172.16.0.1 > > >connection works. However I do not wish to do this. > > >So the question is how do I get arround this. > > > > > >Note the secure Remote client is natted using hide > > >mode behind its firewalls external public address > > > > > > > > > > > > > > > > > > > > > > > > > > >___________________________________________________________ > > >ALL-NEW Yahoo! Messenger - all new features - even more fun! > > >http://uk.messenger.yahoo.com > > > > > >================================================= > > >To set vacation, Out-Of-Office, or away messages, > > >send an email to [EMAIL PROTECTED] > > >in the BODY of the email add: > > >set fw-1-mailinglist nomail > > >================================================= > > >To unsubscribe from this mailing list, > > >please see the instructions at > > >http://www.checkpoint.com/services/mailing.html > > >================================================= > > >If you have any questions on how to change your > > >subscription options, email > > >[EMAIL PROTECTED] > > >================================================= > > > > ================================================= > > To set vacation, Out-Of-Office, or away messages, > > send an email to [EMAIL PROTECTED] > > in the BODY of the email add: > > set fw-1-mailinglist nomail > > ================================================= > > To unsubscribe from this mailing list, > > please see the instructions at > > http://www.checkpoint.com/services/mailing.html > > ================================================= > > If you have any questions on how to change your > > subscription options, email > > [EMAIL PROTECTED] > > ================================================= > > > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= > ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
