Security

Ask something
Discussion Locked

Connecting 2 firewalls

0 helpful
7 replies

by kashmeir63

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,
I have an unusual problem. I have a windows 2000 server in 1 state and a windows nt server in another. I'm trying to connect two Sonic walls(firewall) to each other. I'm able to accomplish this, the two firewalls are able to communicate and from the windows 2000 server I could ping only only 1 of my 10 servers. The one I could ping is my PDC, Wins and DHCP(all on one server).
And I'm able to ping the windows 2000 server from the nt side.Would anyone know the reason why I could ping only the one server and not the other ones on my network. Any help would be appreciated.

7 replies

by mshavrov

First of all, you should check routing on both, Windows servers and routers/firewalls. On servers you should have "default route" (0.0.0.0), pointing to firewall.

Second, you should check your firewalls, what kind of traffic is permitted and to/from which servers.

Third, sice you are talking about "state-to-state" communication, most likely you have VPN tunnel between firewalls. Check parameters, how they are configured and what traffic is protected.

If you have more comments or questions, e-mail me directly.

Michael Shavrov
MCSE W2K, MCSE+I, Checkpoint CSSA, Security+, Cisco CCNP, CCDP, CCSP.

by cw

This is a limited amount of information to go on. I am assuming you have an IPSEC or GRE tunnel between the two SonicWalls connecting the two foriegn subnets. Routing beyond an IPSEC tunnel is not automatic on firewalls, and normally static routing needs to be set on both routers for the network addresses that hosts will access from either side.

I would also look at access-list configuration on the firewalls, is ICMP permitted to all hosts on both ends? The best answer is to "Hub" in with a Sniffer (I recommend Etherpeek)on the NT side of the network on either side of the Firewall. This will show you exactly how far your ICMP packets are going and make it easy to isolate the issue.

I wonder if

by d.walker5

NT servers authenticate using a NULL string. Add the Everyone group to the Pre-Windows 2000 group. Alow Full Controll. This should slove your problem.

This discussion is closed to new replies.