topic Re: Allow an encrypted communication channel between servers in Firewall and Security Management

Allow an encrypted communication channel between servers

Vitaliy_Isaenko — Fri, 26 Aug 2022 09:10:39 GMT

Hi, i'm Vitaliy

IPSEC vpn is installed between 2 branches on virtual gateways c R80.40 and R81.10. each of the branches hosts software components that communicate with each other via an encrypted communication channel based on ipsec ESP (this is the developer's requirement). How do I allow the establishment of an encrypted channel inside an existing tunnel?
If you need screenshots of the settings, I will provide them.

Re: Allow an encrypted communication channel between servers

PhoneBoy — Sun, 28 Aug 2022 05:37:09 GMT

Pretty sure what you’re asking for is an RFE.

Re: Allow an encrypted communication channel between servers

the_rock — Sun, 28 Aug 2022 16:33:24 GMT

I think if you give the screenshots, it may help.

Re: Allow an encrypted communication channel between servers

Vitaliy_Isaenko — Sun, 28 Aug 2022 19:57:41 GMT

Hi, PhoneBoy! Excuse my ignorance, but can't you explain what "RFE" means?

Re: Allow an encrypted communication channel between servers

the_rock — Sun, 28 Aug 2022 20:23:13 GMT

It means request for enhancement...something that is not implemented, but can be requested.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk71840&partition=Basic&product=All

Though, not to be a debbie downer as they say ( : - ), but the way these work with ANY vendor out there is that they would most likely consider it ONLY if there are enough customers asking for it and there is a business need for it. Otherwise, they wont bother...but, you are certainly welcome to submit it, that costs no money : - )

Re: Allow an encrypted communication channel between servers

Vitaliy_Isaenko — Sun, 28 Aug 2022 20:28:07 GMT

Hi, the_rock. Screenshots of which settings should I provide? I will provide the general ones to begin with and if something is missing, then specify which ones to add.

Re: Allow an encrypted communication channel between servers

the_rock — Sun, 28 Aug 2022 21:34:49 GMT

K, sorry, maybe I misunderstood your request...what EXACTLY are they asking you to do?

Re: Allow an encrypted communication channel between servers

Vitaliy_Isaenko — Mon, 29 Aug 2022 06:53:38 GMT

Hi!
The task boils down to the following: it is necessary to ensure the passage of encrypted traffic over the ESP protocol inside an ipsec tunnel installed between two Check Point security gateways. I have published screenshots of one security gateway with the settings made. On the second one they are similar except for the ip address on the external interface

Re: Allow an encrypted communication channel between servers

_Val_ — Mon, 29 Aug 2022 06:58:40 GMT

Hi, although it is a good idea to discuss the requirements here, the actual RFE process is different.

To submit an RFE, use the following URL:

https://www.checkpoint.com/rfe/rfe.htm

Please provide:

A brief description of the requested change
Contact Information
Detailed description of the problem or circumstances leading to the requested change
Product/Version
OS

Re: Allow an encrypted communication channel between servers

Vitaliy_Isaenko — Mon, 29 Aug 2022 07:07:06 GMT

Hi, _Val_!

It turns out that the problem we encountered during setup is a temporary limitation of Gaia functionality?

The link to RFE is not working, below is a screenshot

Re: Allow an encrypted communication channel between servers

G_W_Albrecht — Mon, 29 Aug 2022 07:42:17 GMT

Allow communication for all needed services for each component - then all will be routed thru VPN. What exactly is the error or issue you have ?

Re: Allow an encrypted communication channel between servers

_Val_ — Mon, 29 Aug 2022 08:15:32 GMT

Correct, the link is down, I have alerted the relevant team.

Could you please elaborate on "a temporary limitation of Gaia functionality" statement?

Re: Allow an encrypted communication channel between servers

Vitaliy_Isaenko — Mon, 29 Aug 2022 08:36:41 GMT

We are faced with the problem of establishing an encrypted connection between two components of a software product inside an ipsec tunnel between Check Point security gateways.
I understand that "RFE" implies a revision of the OS functionality that does not work correctly. If I put it wrong, then correct me

Re: Allow an encrypted communication channel between servers

Vitaliy_Isaenko — Mon, 29 Aug 2022 11:28:57 GMT

Hi, G_W_Albrecht!

If we are talking about setting up an access control policy, then in our case there are no restrictions on services inside the tunnel.

Re: Allow an encrypted communication channel between servers

the_rock — Mon, 29 Aug 2022 13:35:48 GMT

I agree with @G_W_Albrecht ...I cant seem to come up with any other way.

Re: Allow an encrypted communication channel between servers

G_W_Albrecht — Mon, 29 Aug 2022 15:21:22 GMT

What exactly is the error or issue you have ?

Re: Allow an encrypted communication channel between servers

Vitaliy_Isaenko — Thu, 08 Sep 2022 08:04:24 GMT

Hello everyone!
Thank you for your time and advice. As it turned out, the problem was not in the settings of the security gateways, but in a software product that used an encrypted tunnel between its components. As for the Check Point security gateways themselves, they allow you to build another encrypted tunnel inside the Site-to-Site VPN without any problems.

Re: Allow an encrypted communication channel between servers

G_W_Albrecht — Thu, 08 Sep 2022 10:33:53 GMT

What you ask for is easily accomplished - contact TAC to resolve it, the few details explained here give us no clues whatever...