topic Re: Which VPN need to Choose to setup with Cloud based Proxy vendors in Firewall and Security Management

Which VPN need to Choose to setup with Cloud based Proxy vendors

Upen0003 — Fri, 31 Jan 2020 09:13:51 GMT

Hi everyone,

I need to setup 2 VPNs (Primary & Secondary) with my CP to Cloud based Proxy vendor, now I want to know which type of VPN I need to setup between peers, either policy based or route based.

I need to forward all Internet traffic to this VPN tunnel so it can be proxied by the cloud based proxy solution.

If I setup policy based VPN, how traffic will be shifted to secondary VPN if my primary tunnel goes down..

Re: Which VPN need to Choose to setup with Cloud based Proxy vendors

PhoneBoy — Sat, 01 Feb 2020 00:49:01 GMT

Without knowing what vendor we're talking about, what instructions they provide, and your gateway version/JHF level, it's impossible to provide accurate advice here.
But, in general, DPD is an industry-standard mechanism that can be used for failover purposes.

Re: Which VPN need to Choose to setup with Cloud based Proxy vendors

Chris_Atkinson — Sat, 01 Feb 2020 03:06:54 GMT

The tunnels won't be GRE that much is for certain.

Is their a specific reason you need the 3rd party proxy rather than leverage the capabilities of your Check Point?

Re: Which VPN need to Choose to setup with Cloud based Proxy vendors

Tomer_Sole — Sat, 01 Feb 2020 06:12:53 GMT

Have you considered CloudGuard Connect, letting you unify your on-prem and cloud policies under a single management and achieving a consistent NSS-certified high level of security?

Re: Which VPN need to Choose to setup with Cloud based Proxy vendors

upendras — Sun, 02 Feb 2020 12:21:39 GMT

vendor is Symantec and they said forward all your internet traffic to me via VPN, they will proxied the traffic and forward that to internet post NAT..

I am using R80.10 and want to know if I configure policy based VPN then how my GW will start using backup tunnel in case primary tunnel goes down.

if I use route based tunnel in that case I need to create a tunnel interface and set the default route to that VTI..

want to confirm which type of VPN will be good to have in this situation.

Re: Which VPN need to Choose to setup with Cloud based Proxy vendors

mdjmcnally — Mon, 03 Feb 2020 07:28:59 GMT

https://support.symantec.com/us/en/article.tech253914.html

When vendors want you to do this then they typically publish a document on how to achieve what they ask.

This is from the Symantec Site about how to configure.

Whilst it is for R77.30, configuring VPN's really hasn't changed much, so this is till useful in terms of what to configure.

Please note that says to create Permanent VPN Tunnels and to enable DPD, Dead Peer Detection which is done via the GUIdbedit tool.

This doc refers to a Policy or Domain based VPN so this should answer your question.