Jump to content



Hi all

Please try to stick with me over this, its complicated and I've inherited it. Its been driving me crazy for a few days now so here goes (I think this is all the info)

My company has a public IP range of 194.xxx.xxx.32 - 63

We have a Checkpoint R65 with 5 interfaces as below

LAN - - LAN Core Switch
DMZ - - DMZ Switch
3rd Party Site - - Switch and then WAN out
External (Heres where the fun starts!) - 194.xxx.xxx.32 - 47 --> To ISP router
No NAT DMZ - 194.xxx.xxx.49 - 55 --> To a VLAN on a switch.

The last two interfaces have been subnetted as /28 and /29 respectively

We have Internet facing services on .57 and .58 that are reachable despite not falling into any of the subnets defined on the bottom interfaces!?

Anyway, we have a need to allow a LAN server on 5.153 talk to an environment on At present, this works via a route on the Firewall from the address via which is connected directly via a transit network (invisible to us @ Layer 3) to the

I need to use the interface that this uses so I have configured a VLAN on a (Layer-3 HP) switch ( and given my server that as its default gateway. The VLAN mirrors the Firewall config in that its IP address is with the correct gateway and a route exists on the switch for via The switch can see a device at (via ping) but my server can't ping out to it.

All the 172 addresses are /24 networks with Inter VLAN routing on switches where appropriate.

I'm sure i've missed something simple but I'd really like somebody objective to throw some ideas in - also , any Checkpoint people - can you suggest why the services on the .57 and .58 WAN addresses are reachable?


Share this post

Link to post
Share on other sites

2 answers to this question

  • 0


it looks as if you are missing a route on your layer 3 switch. It sounds like you have multiple layer3's there and routing on one switch isn't pointing to the other switch to enable communication. Basically switch a doesn't know that switch b has x subnet.

Share this post

Link to post
Share on other sites
  • 0


Thanks for the reply - I believe that is the case. All the switches are HP Procurves and the switch that has the address (and also lives on an address on our LAN) has a route set up but the "IP Routing" command doesn't appear in the config so the switch is only operating at Layer 2 and thus can't route

At least, I hope that's the case! I'll find out later today when I get chance to test

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.