topic Re: Site-To-Site connectivity and application access in Firewall and Security Management

Site-To-Site connectivity and application access

BSBhatia — Wed, 01 May 2019 10:10:39 GMT

After migration to checkpoint firewall 5900 (R80.10) at two geographically separated sites, network access from one site to another does not work, when the tunnel terminating on the edge routers of the two sites is in place. But as soon as the tunnel is removed between the two edge routers network access is enabled and applications across the sites become accessible.

Kindly help to fix the issue.

Thanks

BS Bhatia

Re: Site-To-Site connectivity and application access

Nick_Doropoulos — Wed, 01 May 2019 19:13:55 GMT

Hi Bhatia,

Would you mind sharing with us a basic diagram of your topology?

Many thanks.

Nicholas

Re: Site-To-Site connectivity and application access

BSBhatia — Thu, 02 May 2019 06:10:34 GMT

The topology diagram is attached as file "Diagram.docx".

Re: Site-To-Site connectivity and application access

PhoneBoy — Fri, 03 May 2019 22:11:33 GMT

If I'm understanding this correctly, you have routers between the two Check Point gateways doing an IPSec tunnel between the two sites, correct?
Generally, that's going to cause MTU issues.
What I suspect is happening is the following:

Large packet comes through Gateway A with the Don't Fragment Bit set
When that large packet hits the router and it tries to go through the IPsec tunnel, the packet + IPsec header will be larger than the MTU
The router is sending back an ICMP message back saying "Fragmentation Needed" which is getting dropped at the firewall

The end result is traffic doesn't work.
You can easily confirm all of the above with tcpdump or similar.

The solution is pretty simple: configure the access policy to allow ICMP Fragmentation Needed packets from the router.

Re: Site-To-Site connectivity and application access

BSBhatia — Mon, 06 May 2019 11:00:46 GMT

Thanks a lot for the solution.

After reducing the MTU on firewall interface connected to the edge router at both the ends (to 1320), network access across the sites is working fine.