Route Problem

Unfortunately, I'm not real familiar with Checkpoint so I can't offer specific instructions but many times default configurations for firewalls include a line that filters ICMP (ping) packets.

The other possibility is that IP routing is not enabled or that the gateways are not properly set. Either one could explain why you can ping the gateway NICs but not beyond them.

I know this isn't a very complete answer but maybe it can give you a start in solving the problem.

Regards!

paul

try the following:
Add a static route to each computer with the route command

I would be tempted to say that you don't have IP Forwarding enabled, but if you can ping back and forth between the two 172.x.x.x nets, then you must.

As Checkpoint says, you should always ensure that routing works before installing the firewall. Make sure that you stop the Firewall-1 service while testing the routing.

Now, do you have a default gateway set up? you should have only one default gateway on the firewall (normally pointing to your Internet router).

Aside from that, I cannot say much without more specifics. If you are still stuck, Do a route print and post the results.

Please post a ROUTE PRINT.

I appreciate the additional info and I'm just thinking out loud here, but is it possible that IP Forwarding is not working but you can ping both 172* subnets because your subnet mask is 255.255.0.0 (i.e. Class B rather than Class C)?

paul

Hi Larry. I see two problems with the route print (provided that they are not simply typos).

First one>
134.241.92.0 255.255.252.0 134.241.92.2 134.241.92.2 1
Here you have the mask as 255.255.252.0 where it should presumably be 255.255.255.0.

Second>
172.16.92.2 255.255.255.255 134.241.92.2 134.241.92.2 1
I'm not sure why this entry is in there, but I can imagine that it must be causing some problems. Get rid of it.

Make these changes and let me know how it goes.

Larry,
the subnet mask on your 134 network is not necessarily wrong. Just wanted to make sure.

It's entirely possible, given the symptoms, that the problem is simply the routing table on the client machines in the 134 network.

If the only default gateway they know is the internet router, that would explain why any attempt to get from a 134. machine to one of the 172. networks would fail (and therefore also why communications from 172 to 134 would fail as the 134 machine's response wouldgo to the internet router).

if this is the case, your choices are:

1. add routes into the routing table on the internet router to send 172.x.x.x packets to the firewall. This is easiest if you have admin access to the router.
2. add routes to each host in the 134.x.x.x network to send 172.x.x.x packets to the firewall.

Let me know how it goes.

This question was closed by the author