Jump to content


Firewall (Checkpoint R65) / General LAN Help

  • Please log in to reply
2 replies to this topic

#1 MagicMan



  • Joined: 12-May 03
  • Location: Somewhere in the UK

Posted 20 November 2012 - 00:51

Hi all

Please try to stick with me over this, its complicated and I've inherited it. Its been driving me crazy for a few days now so here goes (I think this is all the info)

My company has a public IP range of 194.xxx.xxx.32 - 63

We have a Checkpoint R65 with 5 interfaces as below

LAN - - LAN Core Switch
DMZ - - DMZ Switch
3rd Party Site - - Switch and then WAN out
External (Heres where the fun starts!) - 194.xxx.xxx.32 - 47 --> To ISP router
No NAT DMZ - 194.xxx.xxx.49 - 55 --> To a VLAN on a switch.

The last two interfaces have been subnetted as /28 and /29 respectively

We have Internet facing services on .57 and .58 that are reachable despite not falling into any of the subnets defined on the bottom interfaces!?

Anyway, we have a need to allow a LAN server on 5.153 talk to an environment on At present, this works via a route on the Firewall from the address via which is connected directly via a transit network (invisible to us @ Layer 3) to the

I need to use the interface that this uses so I have configured a VLAN on a (Layer-3 HP) switch ( and given my server that as its default gateway. The VLAN mirrors the Firewall config in that its IP address is with the correct gateway and a route exists on the switch for via The switch can see a device at (via ping) but my server can't ping out to it.

All the 172 addresses are /24 networks with Inter VLAN routing on switches where appropriate.

I'm sure i've missed something simple but I'd really like somebody objective to throw some ideas in - also , any Checkpoint people - can you suggest why the services on the .57 and .58 WAN addresses are reachable?


#2 sc302


    Neowinian Senior

  • Tech Issues Solved: 57
  • Joined: 12-July 05
  • Location: NJ, USA

Posted 20 November 2012 - 13:36

it looks as if you are missing a route on your layer 3 switch. It sounds like you have multiple layer3's there and routing on one switch isn't pointing to the other switch to enable communication. Basically switch a doesn't know that switch b has x subnet.

#3 OP MagicMan



  • Joined: 12-May 03
  • Location: Somewhere in the UK

Posted 21 November 2012 - 07:46

Thanks for the reply - I believe that is the case. All the switches are HP Procurves and the switch that has the address (and also lives on an address on our LAN) has a route set up but the "IP Routing" command doesn't appear in the config so the switch is only operating at Layer 2 and thus can't route

At least, I hope that's the case! I'll find out later today when I get chance to test