Checkpoint 4.1 external interface(s)

Posted on 2003-03-20
Medium Priority
Last Modified: 2013-11-16
Running Checkpoint 4.1 on Solaris 2.6

I was wondering, is it possible to have two external interfaces on the same network? This is part Solaris question, part Checkpoint.


My understanding is that it wouldn't be possible b/c Solaris wouldn't be able to route packets. But even if I could work it under Solaris, would it work with Checkpoint?
The reason I ask is b/c I can't get two external interfaces to come up without causing serious problems, and I'm starting to think it can't work. I'm just messing around, so its not urgent, but any input would be appreciated. Thanks.
Question by:calic0
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 23

Expert Comment

ID: 8181115

For as far as i now, it's not possible in Checkpoint, it can only support one way out. I think that you would be spoofing yourself. Anyhows, why would like to pull this one off???

Greets Ray

LVL 14

Expert Comment

ID: 8181132
You should be able to this on the Solaris side pretty easily. There are docs on sun.com on how to do this.

And I don't think CheckPoint cares (though I won't swear to it, since it may cause problems for the state table).

But meanwhile, CP 4.1 is no longer supported, so you should be playing around on NG.

Expert Comment

ID: 8181338
You cannot have the same network on two different interfaces.  UNLESS you are doing some sort of fall over between NIC's and even in that case, there would be one "virtual" ip shared between them.

I know on a Cisco Router this is not possible but we are not talking cisco and I have never seen it on a CP firewall.
Put Machine Learning to Work--Protect Your Clients

Machine learning means Smarter Cybersecurity™ Solutions.
As technology continues to advance, managing and analyzing massive data sets just can’t be accomplished by humans alone. It requires huge amounts of memory and storage, as well as high-speed processing of the cloud.

LVL 14

Expert Comment

ID: 8182815
Solariswise: You can definitely have two interfaces on the same network, but must use something BGP to balance them. This is typically done to support redundant NIC's.

CPwise: if this is for redundancy, a more typical way of doing this is to have two complete firewalls and have failover or load-balancing between. This can be done with routing (BGP), with hardware (load balancers), or with software (Stonebeat, etc.)

Expert Comment

ID: 8675986
I think the best way to do this is to set an ip alias, virtual ip or whatever you call it on the external interface .. depending on what you want to do with it .. I'd do this by set up the NIC with one interface and one ip .. then when that's working just do "arp -s secondary_ip external_interface_mac_adress_in_hex pub" then the fw will recieve packets for that ip .. then you can do whatever with them like "route -host secondary_ip some_internal_ip" or something .. a manual old fashioned NAT ..

LVL 79

Expert Comment

ID: 8904717
No comment has been added lately (33 days), so it's time to clean up this TA.
I will leave a recommendation in the Cleanup topic area for this question:


Please leave any comments here within 7 days.

-- Please DO NOT accept this comment as an answer ! --


EE Cleanup Volunteer

Accepted Solution

Mindphaser earned 0 total points
ID: 8996150
Force accepted

** Mindphaser - Community Support Moderator **

Featured Post

New feature and membership benefit!

New feature! Upgrade and increase expert visibility of your issues with Priority Questions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you are like regular user of computer nowadays, a good bet that your home computer is on right now, all exposed to world of Internet to be exploited by somebody you do not know and you never will. Internet security issues has been getting worse d…
Do you have a windows based Checkpoint SmartCenter for centralized Checkpoint management?  Have you ever backed up the firewall policy residing on the SmartCenter?  If you have then you know the hassles of connecting to the server, doing an upgrade_…
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …
Have you created a query with information for a calendar? ... and then, abra-cadabra, the calendar is done?! I am going to show you how to make that happen. Visualize your data!  ... really see it To use the code to create a calendar from a q…
Suggested Courses

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question