topic Re: GRE Tunnel in Firewall and Security Management

GRE Tunnel

Vijay_Nagaraj — Fri, 11 Oct 2019 19:19:02 GMT

Hi Experts,

I believe the the GRE tunnel cannot be terminated in the Check Point firewalls (Please confirm if by any way or in any version hardware or software or any model its supported). Also this GRE is proprietary of other vendor, is that a reason CP does not support or any other technical reasons there? Please let me know, any information is highly appreciable.

Thanks in advance.

Vijay

Re: GRE Tunnel

Nick_Doropoulos — Fri, 11 Oct 2019 19:31:48 GMT

Hello,

GRE tunnels are not supported on Gaia OS. Please see sk92845 for more information.

Thanks.

Re: GRE Tunnel

PhoneBoy — Fri, 11 Oct 2019 22:24:11 GMT

GRE is not supported on Gaia and, as far as I know, there are no plans to add such support.

GRE is hardly proprietary as it is a standard Linux kernel module.
It was possible in some older versions of Gaia to enable the necessary drivers and manually configure these interfaces using standard Linux commands.
However, none of the Gaia infrastructure recognizes GRE interfaces.

Re: GRE Tunnel

Vijay_Nagaraj — Sat, 12 Oct 2019 14:14:12 GMT

Thanks for the response!!

Re: GRE Tunnel

Vijay_Nagaraj — Sat, 12 Oct 2019 14:14:38 GMT

Thanks for your response..

Re: GRE Tunnel

G_W_Albrecht — Tue, 15 Oct 2019 11:28:53 GMT

According to Wikipedia, Generic Routing Encapsulation (GRE) is a tunneling protocol developed by Cisco Systems. Linux and BSD can establish ad-hoc IP over GRE tunnels which are interoperable with Cisco equipment.

sk92845: Can users create a GRE tunnel on Gaia OS?

sk157893: Check Point recommendations for tunneling through IPsec instead of GRE

sk60793: Configuring Security Gateways to allow connection to PPTP server while using Hide-NAT (GRE and Hide-NAT support)

sk90060: GRE tunnel stops working inside a Site-to-Site VPN tunnel established with Check Point cluster

sk96071: Check Point 600/1100 Appliances drops GRE packets

Re: GRE Tunnel

Gera_Dorfman — Tue, 15 Oct 2019 22:26:14 GMT

There is a Hotfix on top of R80.10 supporting GRE tunnels on Gaia
The plan is to support GRE in the main-train in the first major release in 2020.

Re: GRE Tunnel

Tom_Vandepoel — Tue, 19 Nov 2019 14:57:25 GMT

Hi Gera,

I just opened a support case with TAC to get more info on GRE support. This is the answer I received:

"I consulted with the developers and verified sk92845.
termination of GRE traffic is not supported on Check Point Gateway.

You may refer to the local office to request for Request for Enhancement.

Please let me know in case further information is needed."

Could you point me to up to date information on GRE support as it seems TAC doesn't have the right info...

Thanks,

Tom.

Re: GRE Tunnel

Gera_Dorfman — Tue, 19 Nov 2019 15:00:38 GMT

Hi Tom
The HF was developed as RFE for another customer, so that's the reason for TAC response.
Let's discuss it offline - can you please send me an email to gerad@checkpoint.com , and I will ask my team to see if and how we can help.
Thanks
Gera

Re: GRE Tunnel

Alex_Lewis — Mon, 10 Aug 2020 17:14:22 GMT

is there any update concerning GRE support on Gaia? Is the hotfix that was available for R80.10 also available for R80.30 and R80.40?

Re: GRE Tunnel

Gera_Dorfman — Mon, 10 Aug 2020 17:17:10 GMT

GRE is in R81 which we plan to GA soon and we're looking for EA customers.

Re: GRE Tunnel

PhoneBoy — Mon, 10 Aug 2020 19:28:45 GMT

That was a customer-specific hotfix that had some limitations associated with it, including support for future jumbo hotfixes.
Those generally don’t get ported to other releases but rather integrated as part of a maintrain release, such as R81.
Best to join the R81 Early Availability program.

Re: GRE Tunnel

John_Le — Thu, 08 Oct 2020 03:18:20 GMT

Hi Gera,

Would you be able to advise on whether GRE tunnel support for R81 will also include GRE support in a VS?

Kind regards,

John.

Re: GRE Tunnel

Sanjay_S — Fri, 12 Nov 2021 12:52:57 GMT

Hi Gera,

We are on R81, if this supports GRE can i get the implementaion guide for the same please?

Regards,

Sanjay S

Re: GRE Tunnel

PhoneBoy — Fri, 12 Nov 2021 18:15:01 GMT

Start with the product documentation: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/GRE-Interfaces.htm?Highlight=gre

Re: GRE Tunnel

Gera_Dorfman — Sat, 13 Nov 2021 16:06:42 GMT

https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eventSubmit_doGoviewsolutiondetails=&solutionid=sk169794

Re: GRE Tunnel

Sanjay_S — Mon, 22 Nov 2021 10:32:18 GMT

Hi PhoneBoy,

If it possible to create the GRE tunnel over IPSec as we do in the Cisco routers?

Regards,

Sanjay S

Re: GRE Tunnel

PhoneBoy — Mon, 29 Nov 2021 20:44:21 GMT

I don't believe that's supported, no.
Am curious why you'd tunnel GRE in IPSec, though.

Re: GRE Tunnel

Tom_Vandepoel — Tue, 30 Nov 2021 07:09:30 GMT

Why? For exactly the reason that Sanjay mentioned. The old-school way of doing routed vpn on Cisco IOS devices uses IPSEC in GRE. Nowadays, it's not actually necessary anymore to do routed vpn this way on cisco (you have now Virtual Tunnel Interfaces).

Some companies still use that old "technology" though and we have one customer that needs to setup such a tunnel with another company that (for whatever reason) insists on using IPSEC in GRE... so indeed this feature would be appreciated 😉

Thanks,

Tom

Re: GRE Tunnel

IS4IT_CheckPoin — Mon, 04 Dec 2023 08:31:34 GMT

hi Gera,

Is it possable to encypt the GRe tunnel. this could bd dome by making the tunnel endpoint intresting for encrpted traffic. thanks!