🚀 go-pugleaf

NG can do automatic ARP configuration unlike 4.1. I've just built an NG FP2
firewall using automatic NAT, no local.arp and no routes and it works a
treat.

Chris.


"news-west.newscene.com" <lynxo78@nospamhere.hotmail.com> wrote in message
news:3d75c4e1$0$352$45beb828@newscene.com...
> Hi,
>
> Im studying for my checkpoint firewall NG exam, I have setup a test
> environment with 3 pcs, 1 pc each on a different subnet and one as the
> router. This is the environment:
>
> subnet 1 (simulated internet): 192.168.253.0/24
>
> subnet 2: 10.1.1.0/24
>
>
> pc1 (subnet 1) -
>
> 192.168.253.101/24
>
> pc2 (subnet 2) -
>
> 10.1.1.2/24
>
> router (running NT4 server sp6a with ip forwarding enabled)
>
> subnet 1 address: 192.168.253.125/24
> subnet 2 address: 10.1.1.1/24
>
> I have installed NG with FP2. It seems to be working fine and I have
managed
> to get NAT working but im not sure I have done it correctly. I have been
> reading some documentation about adding a static NAT public to private
> address rule. It mentions that you need to add an object with a routable
> address. In this case, as a test I want to use 192.168.253.126.
>
> My policy rules allow everything. My NAT rules read like this, only
relevant
> info shown..
>
> 1. (source) 10.1.1.2 ( dest) any (service) any / (source) 192.168.253.126
> (dest) original (service) any
> 2. (source) any (dest) 192.168.253.126 (service) any / (source) any (dest)
> 10.1.1.2 (service) any
>
> Now this should allow traffic out from 10.1.1.2 to 192.168.253.x at
least...
> it doesn't. I'm assuming that this is because 192.168.253.126 is not
really
> bound to anything, so the packet doesn't know where to go??
>
> To get it working I edited the object 192.168.253.126 and changed it to be
> automatic static NAT with an address of 192.168.253.126. This added a rule
> above the existing one. Outgoing traffic now works. Is what I have done
> correct?
>
> To get inbound services working I created a local.arp file (which wasn't
> there) in the conf directory. Restarted NG, works fine. I was curious as
to
> why you can't use the NT arp command to add a static entry (at least thats
> what the docs say). I added a static entry and deleted local.arp and
> restarted etc.. it still works?? I cleared out arp caches first etc.. Why
do
> they say you can't do this?
>
> Thanks for any help or advice.
>
> James
>
>
>
>
>