topic Re: Checkpoint 77 to AWS in Cloud Firewall

Checkpoint 77 to AWS

clement_locricc — Fri, 28 Apr 2017 06:59:12 GMT

Hi,

I have some difficulty to etablish a connection between a checkpoint 77 and AWS, I have followed the guide on checkpoint, but the tunnel is still down .

If anybody have some help thx

Re: Checkpoint 77 to AWS

PhoneBoy — Sat, 29 Apr 2017 00:35:09 GMT

A bit more context here would be helpful.

What exact version of code are you working with on the local end? Base version, applied jumbo hotfixes, etc.
Are you trying to establish a VPN with a Check Point inside of AWS or are you terminating to the AWS VPN endpoint?
Which documentation did you try to follow?
What errors are you seeing in SmartLog?

Re: Checkpoint 77 to AWS

clement_locricc — Sun, 30 Apr 2017 08:24:43 GMT

A little bit more context and information :

The checkpoint is a R77.10
I'm trying to etablish a connection between a checkpoint (On-premise) and to terminate to the AWS VPN endpoint.
I have tried to follow the " https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk100726 "
I can see the following in Smartlog :

"Key Installed : TUNNEL STATUS CHANGE: Peer gateway AWS1 has changed status to DOWN "

Re: Checkpoint 77 to AWS

PhoneBoy — Sun, 30 Apr 2017 19:55:38 GMT

Are you using VTIs or not? This is generally the better approach, but it disables CoreXL.

Also the SK suggests using MSS Clamping, which may be needed and will require upgrading to R77.20 and above.

You might want to do that anyway since R77.10 will be End of Support in August 2017: Support Life Cycle Policy | Check Point Software

As troubleshooting VPNs in general is fairly complex, I would recommend engaging with the TAC to assist.

Re: Checkpoint 77 to AWS

clement_locricc — Mon, 01 May 2017 01:49:58 GMT

Thanks you for the informations.

I have managed to turn the VPN UP. But I still have issue when trying to reach my subne, any idea ?

Re: Checkpoint 77 to AWS

PhoneBoy — Mon, 01 May 2017 03:48:12 GMT

You might want to see if this applies: "Encryption failure: Wrong peer gateway for decrypted packet (VPN Error code 01)"