Hello,
We are having a problem with our SecurePlatform FW1 NGX ClusterXL High
Availabilty R62 dhcp-relay configuration.
We have configured ethernet interfaces for DHCP-relay and added to our
policy a couple of rules to allow dhcp relay packets back and forth.
DHCP relay works correctly except for our Windows XP SP2 clients which
have windows firewall activated.
We found that the fw1 is doing a source port translation, and it seems
that windows firewall doesn't like packets originating from a port other
than 'official' DHCP source port.
Windows firewall has a fixed startup policy which drops these packets
and can't be modified. This startup policy overrides any exception you
could configure in windows firewall policy.
- Did any of you have seen this port translation problem before?
- Is there any way I could tell fw1 not to translate dhcp source ports?
It's doing this translation on rule 0 (implied NAT rule?), translates
source IP address from the working node address to the cluster address,
as well as source UPD port.
We have tried exactly the same configuration in a non-cluster
configuration, and works smoothly. The problem arises when using two
node HA cluster.
Any help, advice or idea would be greatly appreciated.
10.9.0.8 is the IP address of one of the nodes
10.9.0.1 is the Cluster XL IP address
This is the problematic connection's log.
Product: VPN-1 Power/UTM
Action: Accept
Protocol: udp
Service: dhcp-rep-localmodule (68)
Source: buzz (10.9.0.8)
Destination: Broadcast (255.255.255.255)
NAT rule number: 0
NAT additional rule number: 0
Source Port: bootp (67)
XlateSrc: toy (10.9.0.1)
XlateSPort: 11188
SmartDefense Profile: Default_Protection
Information: service_id: dhcp-rep-localmodule
Thanks in advance.
--
_____________________________________________________
Eduardo Bergasa Balda
UNIVERSIDAD DE LA RIOJA
Servicio Informático Seguridad Técnica Informática
C/Avenida de La Paz, 93 Tf:+34-941-299560
26006 Logroño - SPAIN Fx:+34-941-299180
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to LISTSERV AT amadeus.us.checkpoint DOT com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner AT ts.checkpoint DOT com
=================================================
|
