IP POOL NAT Question

[linuxsrc]

Configurating the RemoteAccess VPN using IP POOL NAT, defined the IP POOL for NAT, and the SecuRemote client can 'ping' the Internal interface of the firewall, but can not 'ping' other Internal machines.

I can see the 'echo request' from NATed Internal IP address of SecuRemote client, and the internal host send 'arp' request to the firewall, the firewall recievie the arp request, but the firewall do not answer the request.

What's the reason? anyone can help me? thanks.

Linuxsrc

[pavan_lotus]

hi does any one know , how to connect VPN between PIX and Checkpoint...

[brycec]

A possible answer for linuxsrc...

Have you defined your encryption domain on the firewall?
In global properties for the firewall object will be a VPN section in which you need to define your encryption domain. You have two options, create a group object of ip ranges or simply choose the default option which means the firewalls encryption domain is every interface on the firewall (except the external one).

[northlandboy]

Why is the internal host sending an ARP request? Why not define your IP Pool as a network that doesn't physically exist anywhere on the network, then set up the network to route to the firewall to get to that network. That way the internal hosts will simply route their traffic to the firewall, it will intercept the traffic, and de-NAT it/encrypt it to send it back to the client.

Is the firewall configured to do proxy ARP otherwise? If it's not, why would it respond to an ARP request for an IP it's not configured to ARP for?