topic Traffic to public peer it's always encrypted in VPN community tunnel in Firewall and Security Management

Traffic to public peer it's always encrypted in VPN community tunnel

gcarella — Sat, 27 Mar 2021 01:58:46 GMT

Hi all,

I would like to discuss with the community about a strange behavior that I'm experiencing on Check Point security gateway.

I state that I'm quite new with Check Point and I have less than 1yr of hands-on experience on this products. Therefore I often have doubts about topics or features that maybe are obvious to many.

Anyway what it's struggling me from some time is that when for example I launch a ping to a public peer of an active VPN community (star), the traffic is encrypted and sent over that tunnel instead to travel unencrypted towards internet interface.

For me this is a strange behavior I'm expecting that traffic shall go directly on internet as it happens on other VPN S2S implementation that I manage with other vendors.

The issue is present on Check Point SecGateway and CloudGuard, both with R80.30.

Any idea why this happens?

Thanks,

Re: Traffic to public peer it's always encrypted in VPN community tunnel

PhoneBoy — Sat, 27 Mar 2021 05:00:10 GMT

The gateway interfaces are always included in the encryption domain, even if you don't explicitly include them.
To exclude a given IP from encryption: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk25675

Re: Traffic to public peer it's always encrypted in VPN community tunnel

the_rock — Sat, 27 Mar 2021 17:51:47 GMT

@PhoneBoy is 100% correct. Interfaces would be technically part of vpn domain by default, but if you follow the sk mentioned, you should be able to exclude them.

Andy

Re: Traffic to public peer it's always encrypted in VPN community tunnel

gcarella — Sun, 28 Mar 2021 18:03:17 GMT

Thanks a lot.

There is a specific reason why the Secure Gateway includes public peers in the encryption domain?

Re: Traffic to public peer it's always encrypted in VPN community tunnel

PhoneBoy — Mon, 29 Mar 2021 00:08:23 GMT

No idea but it has been the default behavior pretty much since the product supported VPN.