Getting networks behind interfaces to talk

[geelkabouter]

Hi Guys
I'm a checkpoint newbie(bracing for flame)

I have just setup a management station and one firewal node,on the node I have 5 interfaces of which two of them are dmz,how would i get the other networks to talk to machines in the dmz for example a 172.19.162.X talking to a 172.19.160.x network,do i add routes on the firewall,there are already rules allowing the communication,i can ping the firewall interface but not any of the machines behind it?Any suggestions

Thanks

[Joncon]

If the rules on the firewall already exist to allow communication between the 2 subnets you should just have to configure a static route on the firewall O/S. What platform is the firewall running on?

[geelkabouter]

Its running on secure platform,should add the static then to point to the interface ip?

[Joncon]

Yes. Add a static route through sysconfig - routing that sends all traffic for the dmz subnet throught the dmz connected interface on your fw.

[BarryStiefel]

Originally Posted by geelkabouter

Hi Guys
I'm a checkpoint newbie(bracing for flame)

I have just setup a management station and one firewal node,on the node I have 5 interfaces of which two of them are dmz,how would i get the other networks to talk to machines in the dmz for example a 172.19.162.X talking to a 172.19.160.x network,do i add routes on the firewall,there are already rules allowing the communication,i can ping the firewall interface but not any of the machines behind it?Any suggestions

Thanks

We generally don't have any flaming here. Check Point products are so complex and have so many issues that almost everyone here is a newbie in some way or another. Ask when you have questions, help out when you have answers.

[Joncon]

Barry,

I agree, we generally don't have any flamming here. It's generally a nice, relaxed atmosphere on this forum. Such a refreshing change to a number of other forums where the sole intent of some people seems to be to upset others.

Thanks a lot for all your efforts in putting this forum together. It is very much appreciated.

Joncon

[geelkabouter]

Thanks for the help Joncon always good to know people out there are willing to share knowledge,Barry I know you say there is no flaming here but maybe I should get flamed for this one,turns out to be an id10t error from my side as the networking guys plugged in all the interfaces into the same switch,hence the fact the couldnt talk and I never bothered to check!

Thanks for all the help though guys