I havent used fw monitor that much before. I think it is a good tool. But in this this, I actually don't have problems identifying the problem. From the tcpdump, it goes as below,
On LAN Interface, I can see traffic from DMZ CSG server 10.10.10.2 to LAN RSA ACE server 192.168.55.5 and coming back, [EMAIL PROTECTED] tcpdump -i eth0 host 192.168.55.5 tcpdump: listening on eth0 23:42:09.584206 10.10.10.2.10843 > 192.168.55.5.5500: udp 124 23:42:09.584555 arp who-has fw1 tell 192.168.55.5 23:42:09.584599 arp reply fw1 is-at 0:8:2:58:22:4 23:42:09.585808 192.168.55.5.5500 > 10.10.10.2.10843: udp 124 23:42:34.584788 10.10.10.2.10847 > 192.168.55.5.5500: udp 508 23:42:39.579471 arp who-has 192.168.55.5 tell fw1 23:42:39.579608 arp reply 192.168.55.5 is-at 0:8:2:58:21:e0 23:42:39.598666 10.10.10.2.10848 > 192.168.55.5.5500: udp 124 23:42:39.601094 192.168.55.5.5500 > 10.10.10.2.10848: udp 124 23:45:09.168128 192.168.55.5.netbios-dgm > 192.168.40.255.netbios-dgm: NBT UDP PACKET(138) 23:45:17.014385 10.10.10.2.10865 > 192.168.55.5.5500: udp 124 23:45:17.014686 arp who-has fw1 tell 192.168.55.5 23:45:17.014706 arp reply fw1 is-at 0:8:2:58:22:4 23:45:17.015686 192.168.55.5.5500 > 10.10.10.2.10865: udp 124 23:45:42.015078 10.10.10.2.10870 > 192.168.55.5.5500: udp 508 23:45:47.007584 arp who-has 192.168.55.5 tell fw1 23:45:47.007714 arp reply 192.168.55.5 is-at 0:8:2:58:21:e0 23:45:47.027715 10.10.10.2.10871 > 192.168.55.5.5500: udp 124 23:45:47.028748 192.168.55.5.5500 > 10.10.10.2.10871: udp 124 23:46:41.490296 10.10.10.2.10877 > 192.168.55.5.5500: udp 508 23:46:46.493812 arp who-has 192.168.55.5 tell fw1 23:46:46.493939 arp reply 192.168.55.5 is-at 0:8:2:58:21:e0 23:47:06.479128 10.10.10.2.10880 > 192.168.55.5.5500: udp 508 23:47:11.493303 10.10.10.2.10882 > 192.168.55.5.5500: udp 124 23:47:11.494248 192.168.55.5.5500 > 10.10.10.2.10882: udp 124 23:47:40.975099 arp who-has 192.168.55.5 tell 192.168.40.17 And when look at the DMZ interface side, I only see CSG packets arrived but nothing heading back. [EMAIL PROTECTED] tcpdump -i eth2 host 192.168.55.5 tcpdump: listening on eth2 00:18:16.182346 10.10.10.2.11088 > 192.168.55.5.5500: udp 508 00:18:21.174710 10.10.10.2.11088 > 192.168.55.5.5500: udp 508 00:18:21.190090 10.10.10.2.11089 > 192.168.55.5.5500: udp 124 00:18:26.188922 10.10.10.2.11088 > 192.168.55.5.5500: udp 508 00:18:31.189793 10.10.10.2.11088 > 192.168.55.5.5500: udp 508 00:18:36.188522 10.10.10.2.11088 > 192.168.55.5.5500: udp 508 00:18:41.190415 10.10.10.2.11092 > 192.168.55.5.5500: udp 508 00:18:46.188137 10.10.10.2.11092 > 192.168.55.5.5500: udp 508 00:18:51.189008 10.10.10.2.11092 > 192.168.55.5.5500: udp 508 00:18:56.187735 10.10.10.2.11092 > 192.168.55.5.5500: udp 508 00:19:01.188614 10.10.10.2.11092 > 192.168.55.5.5500: udp 508 Interesting eh? -----Original Message----- From: Haralambos Klitiropoulos [mailto:[EMAIL PROTECTED] Sent: Monday, 25 October 2004 4:21 AM To: [EMAIL PROTECTED] Subject: Re: [FW-1] NG AI not forwarding RSA SeurID-UDP (UDP 5500) traffic to DMZ Hello, try using the "fw monitor" command on your gateway. It captures packets as they pass through your gateway and can save them in a format that ethereal understands. It can capture packets as they enter and leave every interface of the firewall, so you can observe if NAT happens and where etc. This means that you will see every packet four times (coming and leaving the inbound interface before routing and coming and leaving the outbound interface after routing), but this is configurable. Check Point even has a special version of ethereal available for download that understands and displays the contents of these files with more information. You can find it at http://www.checkpoint.com/techsupport/downloadsng/utilities.html#CPether eal. In that page you will also find a document about "fw monitor". Phil Wang wrote: >Hi all, > >I have a CSG server (10.10.10.2) in DMZ that authenticate via RSA server (192.168.55.5) in LAN. The firewall interfaces are Internet 203.x.x.1/28, LAN 192.168.55.1/24, DNZ 10.10.10.1/24. > >I am migrating the current Symantec firewall to Checkpoint NG AI R55 with Secure Platform. Before migration, this Citrix CSG and RSA infratructure is working fine. After the cutover, I notice the CSG is having difficualty to communication with RSA server. > >On the firewall. LAN interface (192.168.55.1), tcpdump showing 10.10.10.2 are sending udp packets to 192.168.55.5 on port 5500 (showing on smartview tracker as well) and 192.168.55.5 is returning packet to 10.10.10.2 as well. However, on the firewall DMZ interface (10.10.10.10.1), I can only see the packets going from 10.10.10.2 to 192.168.55.5 but not vice versa. And I dont seen any packets drop on the smartview tracker (I have logged all rules and both implied rules and antispoofing). > >I have gone through the rulebase, make sure not NAT translation between DMZ and LAN, also try to adjust options in global properties and smart defence but without any luck. At the same time, tcp and icmp traffic seem to be fine from each side. > >Anyone has seen this before or any idea what it is? > > > >Thanks, > > > >Phil > > > > > > > ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
