VPN Tunnel Setup

[Denda]

Hi There. I have setup a tunnel between my Checkpoint NG FW & a CISCO PIX for specific ftps. The initial tunnel config works fine, but I have a slight issue..

Since the customer has set up our tunnel to our public ip address, every time we try to access their normal website (not the ftp server), it gets rejected, because it's pulling our IP like it should be going to the ftp tunnel...

I haven't had a chance to play with NAT a whole lot, since this firewall was setup by a consultant. I need a little direction on how to set up the internal server ip address (10.X.X.X) to show a different address once it gets out of our firewall. I hope I'm making some sense here, I think this is what needs to happen, I just don't know how to get there. My assumption is that I need an ip address that is different than the internal ip & the public ip. Can I just make this ip address up (following the basic network rules) & tell Checkpoint that int_serv03 (10.X.X.X), is seen as int_serv03_NAT (192.X.X.X) (via NAT), then have the customer at the ftp site reference the 192.X.X.X? Will that work?

 

[Piloria]

not too clear here.

With NAT you set up the internal address on the first page of the server object and then the NAT address on the NAT tab
(will need to use static NAT)

this should then change the ip address when it passes through the firewall to the IP address in the NAT tab.

IT is possible to set up manual NAT rules so that you can specify which networks you want to translate between

 

[Denda]

I think we are on the same page but I'm not explaing it very well..

Our internal server(10.X.X.X) data goes through the firewall NAT, the firewall NAT changes the data IP address as 63.X.X.X.

This 63.X.X.X is what all of our internet traffic gets nat'd as. Since we use 2 different avenues to access data from this customer, we need to be able to access http as well as ftp. The customer is not allowing the http through the tunnel w/the ftp traffic. Basically their rule on their side says... 63.X.X.X is only allowed ftp to cust_ftp_server.

So now when we try to access the website (http), they do not allow it, they only allow ftp traffic coming from our ip address...

I did set up a manual NAT rule to change the ip of any ftp traffic from internal server (10.X.X.X) to 192.X.X.X for traffic only to the customer, but now the customer states they can't use that range either since that is their internal range. What other IP address ranges can I use? I can't remember.

 

[sds222]

Another possible range is 172.16.0.0 - 172.32.0.0.