Adding Public IP from different Ranges

[CPone]

I’m facing some routing issues with checkpoint and I would appreciate if someone can help on this. Here are the details of the problem:



we received a list of valid IP addresses from our ISP in 2001. The IPs were 213.x.y.z /29. We used one of the Valid IP addresses to setup the external interface of our Checkpoint firewall and appropriate licenses accordingly. The remaining IPs were used to host servers and services within our DMZ zone by NATing them behind the firewall. This worked perfectly.



In 2007, we required more valid IP addresses to accommodate additional Internet servers, therefore we requested for additional IP addresses from our ISP. they provided 213.x.y.z /29 (not directly comming after the one we had) to be used by us. According to the ISP, this subnet uses the same upstream gateway as the previous set of IPs.

If I assign one of the new valid IPs to the external interface of the firewall (as a secondary IP), I can ping the interface from the Internet. But when I use one of the valid IPs to host a server in our DMZ zone, I cannot ping that host.

We have some related server that is DESPERATELY waiting to be hosted on the Internet. Please any clue why it is not working?

[RayPesek]

On Nokia? Did you add a proxy ARP entry on the Nokia for that new server IP address?

Ray

[CPone]

actually it is checkpoint on windows.

[RayPesek]

Sorry, I don't have any experience with firewalls on Windows. It still sounds like an ARP problem, though. On SPLAT you would use "fw ctl arp" to see if the ARP is correct. I'm guessing it will work on Windows, but I don't know.

Ray

[rokudan]

It has been a long time since I worked with CP on a Windows gateway.. But have you added a route for the external ip to the internal ip on the gateway?

route add -p 207.123.123.123 mask 255.255.255.255 192.168.1.123

Where 207.123.123.123 is the public IP of your host and 192.168.1.123 is the internal IP.

[CPone]

well what i did is i have added another network card on the server and i gave it a IP from the new subnet and it worked,

i did not try the route, thanks anyway