topic Re: Announce networks behind remote peer VPN to Virtual Network Gateway. Azure in Cloud Firewall

Announce networks behind remote peer VPN to Virtual Network Gateway. Azure

Everest_Aponte — Thu, 31 Oct 2019 19:06:02 GMT

Hello Everybody

I have the following request,

We have an environment on Azure (R80.20 Cluster) and access to On-premises networks through ExpressRoute. We' configuring a tunnel VPN using VTIs with 3rd Party (Cisco). So, I would like to know if possible to announce the networks behind remote peer VPN, for example (10.236.150.128/27) on my virtual network gateway in order to announce it on the BGP to on-premises networks.

Thank you so much for your attention and comments

Best regards

Everest

Re: Announce networks behind remote peer VPN to Virtual Network Gateway. Azure

Tommy_Forrest — Fri, 01 Nov 2019 13:34:55 GMT

Are you aiming to have a IPSEC tunnel across Express Route?

Or are you trying to stand up a tunnel across the internet to your CloudGuard gateways for backup?

Or are you trying to stand up tunnels to your CloudGuard gateways from external internet peers and you need internal resources to go across ER to your CloudGuard gateway and then out to the internet?

Re: Announce networks behind remote peer VPN to Virtual Network Gateway. Azure

Everest_Aponte — Fri, 01 Nov 2019 18:36:54 GMT

Hello Tommy

Thanks for your contact

Basically, We're configuring a Site to Site VPN with a Customer.

Site to Site VPN based VTIs

Peer Remote (Customer) ------------INTERNET --------------- Peer CheckPoint on AZURE

Enviroment Azure

Peer CheckPoint on AZURE --------------ER-------------- ON-Premises

Network Remote Peer: 10.236.150.128/29

Network Peer CheckPoint on Azure: 10.236.1.0/24

Network ON Premises: 10.0.0.0/8

The flow of Traffic: Bidirectional between 10.236.150.128/29 (remote peer network) and 10.0.0.0/8 (OnPremises network)

Yes, This traffic has to go across the Express Route, We need to announce these VPNs networks so that Virtual Gateway.

Thank you so much

Everest

Re: Announce networks behind remote peer VPN to Virtual Network Gateway. Azure

Matthias_Haas — Mon, 04 Nov 2019 07:26:10 GMT

Hi Everest,

I am not sure if this is working and I can not test it in my Azure environment as I do not have a ER running, but may be it´s worth trying:

You could add the remote peer network as additional Address space on the VNET, where your Checkpoint GW is deployed:

This should cause BGP to propagate that network to OnPrem.

In addition you may have to modify your UDRs, so that the remote peer network is actually routed to the Checkpoint GW (you should already have such UDRs I guess)

Matthias