Sign in to follow this  
Followers 0

Firewall (Checkpoint R65) / General LAN Help

3 posts in this topic

Hi all

Please try to stick with me over this, its complicated and I've inherited it. Its been driving me crazy for a few days now so here goes (I think this is all the info)

My company has a public IP range of - 63

We have a Checkpoint R65 with 5 interfaces as below

LAN - - LAN Core Switch

DMZ - - DMZ Switch

3rd Party Site - - Switch and then WAN out

External (Heres where the fun starts!) - - 47 --> To ISP router

No NAT DMZ - - 55 --> To a VLAN on a switch.

The last two interfaces have been subnetted as /28 and /29 respectively

We have Internet facing services on .57 and .58 that are reachable despite not falling into any of the subnets defined on the bottom interfaces!?

Anyway, we have a need to allow a LAN server on 5.153 talk to an environment on At present, this works via a route on the Firewall from the address via which is connected directly via a transit network (invisible to us @ Layer 3) to the

I need to use the interface that this uses so I have configured a VLAN on a (Layer-3 HP) switch ( and given my server that as its default gateway. The VLAN mirrors the Firewall config in that its IP address is with the correct gateway and a route exists on the switch for via The switch can see a device at (via ping) but my server can't ping out to it.

All the 172 addresses are /24 networks with Inter VLAN routing on switches where appropriate.

I'm sure i've missed something simple but I'd really like somebody objective to throw some ideas in - also , any Checkpoint people - can you suggest why the services on the .57 and .58 WAN addresses are reachable?


Share this post

Link to post
Share on other sites

it looks as if you are missing a route on your layer 3 switch. It sounds like you have multiple layer3's there and routing on one switch isn't pointing to the other switch to enable communication. Basically switch a doesn't know that switch b has x subnet.

Share this post

Link to post
Share on other sites

Thanks for the reply - I believe that is the case. All the switches are HP Procurves and the switch that has the address (and also lives on an address on our LAN) has a route set up but the "IP Routing" command doesn't appear in the config so the switch is only operating at Layer 2 and thus can't route

At least, I hope that's the case! I'll find out later today when I get chance to test

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.