topic Re: Different PSKs for external VPN gateway in Firewall and Security Management

Different PSKs for external VPN gateway

Teddy_Brewski — Mon, 03 Oct 2022 13:15:31 GMT

Hello,

Two gateways, FW-GW-A and FW-GW-B, with two separate default routes and public IPs, running Check Point r80.40 and managed by one SmartCenter.

There is a IPSec tunnel with the external client (FW-EXT-CLIENT-A) on one of the gateways (FW-GW-A). We need to setup additional tunnel with the same FW-EXT-CLIENT-A, on another gateway (FW-GW-B), but with the different PSK.

Can I just create another VPN community and set a desired PSK, or it will overwrite the PSK for the first tunnel too? In other words, is PSK bound to the VPN community object or firewall object?

Thank you.

Re: Different PSKs for external VPN gateway

RS_Daniel — Mon, 03 Oct 2022 14:52:38 GMT

Hello,

You can create a new vpn domain and put a different psk. Some troubles can appear regarding encryption domains or the peer IP address, the remote and local vpn domains will be the same for both vpn's? the public IP of the remote gateway will be the same?

Regards

Re: Different PSKs for external VPN gateway

Teddy_Brewski — Mon, 03 Oct 2022 15:16:35 GMT

@RS_Daniel thank you.

The peer IP of FW-EXT-CLIENT-A is the same, public IPs of FW-GW-A and FW-GW-B are different.

Local VPN domains are different too, however the remote VPN domain is the same.

Re: Different PSKs for external VPN gateway

RS_Daniel — Mon, 03 Oct 2022 16:25:49 GMT

Hello,

Local VPN domains are different --> i think it solves any overlapping networks issues, it should work using a new vpn community, i have the same scenario with one customer and didn't have any problem.

Regards