Question on the CheckPoint/firewall NAT

Article View: comp.security.firewalls

Article #494

Back to comp.security.firewalls Previous Next

#494

From: Carl
Date: Sun, 01 Jul 2001 01:27

29 lines
2085 bytes

Hi Firewall Specialist,

    We want to add an interface (eth3) to the firewall (CheckPoint)
connecting to another ISP (ISP B), then we force the internal packet go out
through eth2 and return back through eth3.

    The interfaces of our firewall are,
eth0 - internal (virtual IP)
eth1 - DMZ
eth2 - ISP A (IP:206.0.0.193 NAT:207.0.0.123)
eth3 - ISP B (IP:207.0.0.123)

    The flow of our design is,
1. Internal packet route to eth2
2. The packet is NAT to 207.0.0.123 (as the source IP) in eth2
3. The packet return to 207.0.0.123 (eth3)
4. The firewall lookup the state table and resolve the packet to its
original internal IP.

Q1. Does the design work?  (any problem with state table, or will IP
conflict happen)

Q2. Can the NAT and interface IP reside on different subnet?  Like eth2's IP
is 206.0.0.193, but NAT IP is 207.0.0.123, they belong to different subnet.

Q3. Any other better solution?


Carl

Technical Details

Message-ID: <9hluc2$k8s1@imsp212.netvigator.com>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!news.stealth.net!newsgate.cuhk.edu.hk!newsgate.netvigator.com!imsp212.netvigator.com!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,930444a8fc803e61
X-Google-Attributes: gidf922c,public
X-Google-Thread: 10c44c,5a45823b45aedb73,start
X-Google-Attributes: gid10c44c,public
X-Google-Thread: 102e85,5a45823b45aedb73,start
X-Google-Attributes: gid102e85,public
X-Google-Thread: 10ed20,5a45823b45aedb73,start
X-Google-Attributes: gid10ed20,public
X-Google-ArrivalTime: 2001-06-30 18:32:01 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!news.stealth.net!newsgate.cuhk.edu.hk!newsgate.netvigator.com!imsp212.netvigator.com!not-for-mail
From: "Carl" <carlsbergker@yahoo.com>
Newsgroups: comp.security.firewalls,ernmc.firewall-1,fa.firewall,mail.firewalls
Subject: Question on the CheckPoint/firewall NAT
Date: Sun, 1 Jul 2001 09:27:26 +0800
Organization: IMS Netvigator
Lines: 31
Message-ID: <9hluc2$k8s1@imsp212.netvigator.com>
NNTP-Posting-Host: pcd226040.netvigator.com
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200