topic Routing for VPN community in Firewall and Security Management

Routing for VPN community

the_rock — Tue, 23 Feb 2021 20:02:21 GMT

Hey guys,

I dont ever recall having to this by default, but is there any manual config you would have to do as far as routing through the VPN tunnel once community is configured on CP? I believe all this is inherited based on the community settings and there is no need to add any routes manually via web GUI, but I could be wrong.

Re: Routing for VPN community

JackPrendergast — Wed, 24 Feb 2021 09:39:18 GMT

No, not usually.

Traffic should route over the VPN without you manually adding routes.

Sounds like the remote end isnt presenting all of its subnets if traffic isnt routing correctly.

Re: Routing for VPN community

the_rock — Wed, 24 Feb 2021 13:44:09 GMT

Thats what I thought...I know sometimes they may need to be added manually for RA stuff, but otherwise, no. Thanks for confirming!

Re: Routing for VPN community

Kurt_Abela — Wed, 24 Feb 2021 21:18:58 GMT

Hi,

I assume this is a policy based VPN, in that case it should match the encryption domain. Are you getting any encrypt logs from smart console?

You can also run 'vpn tu tlist' on the gateway to check the SAs and TSs

Re: Routing for VPN community

the_rock — Wed, 24 Feb 2021 21:36:56 GMT

Yes, correct, its policy based.

Andy

Re: Routing for VPN community

Kurt_Abela — Wed, 24 Feb 2021 21:38:43 GMT

So there is no need for routes to be defined as long as the encryption domain is correct.

Kurt

Re: Routing for VPN community

the_rock — Wed, 24 Feb 2021 21:43:45 GMT

Thats what I thought.

Re: Routing for VPN community

JackPrendergast — Wed, 24 Feb 2021 21:49:19 GMT

Are you having issues?

Re: Routing for VPN community

the_rock — Wed, 24 Feb 2021 22:42:42 GMT

Not at the moment...it was something on remote side. Thanks everyone for your input, really appreciate it.

Andy

Re: Routing for VPN community

PhoneBoy — Sun, 28 Feb 2021 18:47:03 GMT

There is a vpn_route.conf file.
Believe it applies only when using SmartLSM but it could apply in other situations also.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk69726&partition=Basic&product=SmartProvisioning,

Re: Routing for VPN community

Vincent_Bacher — Sun, 28 Feb 2021 21:16:53 GMT

I believe (if I am not mistaken) years ago at a customers environment we often used vpn_route.conf without SmartLSM.

We had a VPN to their hub cluster and at used vpn_route.conf to route between their spoke gateways and our gateway.

Worked fine.