topic Re: VPN Multiple interface interoperability device in Firewall and Security Management

VPN Multiple interface interoperability device

Bac26 — Sat, 22 Oct 2022 15:39:18 GMT

I would like set up vpn via an interface (not external we use for others vpn) to vpn community where i have an interoperability device.

How do i send the traffic go out on that interface (all the parameter are for locally managed)? the peer is direct attached on that interface so he know the route to the peer but traffic seems not going to that path. Even other peer on that interface we would like setup vpns and gateway has the route to the peer.

Thank you

Re: VPN Multiple interface interoperability device

the_rock — Sat, 22 Oct 2022 21:54:29 GMT

If you attach simple diagram, it would help us guide you.

Re: VPN Multiple interface interoperability device

PhoneBoy — Sat, 22 Oct 2022 22:42:51 GMT

If you want to terminate VPNs on different interfaces, you need to adjust the Link Selection settings on the gateway object to determine the IP based on the routing table.

Re: VPN Multiple interface interoperability device

Bac26 — Sun, 23 Oct 2022 03:52:38 GMT

Yes but then vpn on external interface won't work anymore

Re: VPN Multiple interface interoperability device

PhoneBoy — Sun, 23 Oct 2022 12:41:25 GMT

It should if you’ve configured it correctly (both Link Selection and the routing)
In any case, a network diagram would be exceptionally helpful.

Re: VPN Multiple interface interoperability device

Bac26 — Sun, 23 Oct 2022 15:53:05 GMT

You mean if set link selection on interface towards internal net when terminate my vpn for intranet the vpn using external interface main address facing internet still still work? I have already VPN facing internet interface .5 and would like to set up vpns to my interoperability device via interface 192.168.1.1. static route to 192.168.2.1 is set.

Re: VPN Multiple interface interoperability device

PhoneBoy — Sun, 23 Oct 2022 16:38:55 GMT

You set the link selection to be based on routing (instead of a fixed value or interface).
See: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SitetoSiteVPN_AdminGuide/Topics-VPNSG/Link-Selection.htm?tocpath=Link%20Selection%7C_____0#Link_Selection

Re: VPN Multiple interface interoperability device

Bac26 — Sun, 23 Oct 2022 17:28:32 GMT

sorry what do you mean exactly? can you share a screenshot?

Re: VPN Multiple interface interoperability device

the_rock — Sun, 23 Oct 2022 20:20:19 GMT

From the doc @PhoneBoy gave you. By the way, if you look in demo dashboard, you can see same settings.

Andy

You configure the settings in SmartConsole

Re: VPN Multiple interface interoperability device

Bac26 — Mon, 24 Oct 2022 02:54:21 GMT

Yes is what I did and choose:

Calculate IP based on network topology

But this parameters is not for locally managed?

Re: VPN Multiple interface interoperability device

PhoneBoy — Mon, 24 Oct 2022 18:03:32 GMT

Assuming you mean a locally managed SMB appliance, there is a similar setting there:

Re: VPN Multiple interface interoperability device

Bac26 — Tue, 25 Oct 2022 03:23:31 GMT

I mean the parameters you told me to set is related to: Remote peers can connect to the local Security. But I need traffic from central gateway to intranet peers go through that interface

Re: VPN Multiple interface interoperability device

Gomboragchaa — Tue, 25 Oct 2022 06:50:22 GMT

I assuming that you cannot use 2 interface for 2 vpn with interoperability device. I had a same issue a long time ago and CP cannot use 2 vpn interfaces with 3rd party gateways. I am not sure the latest gaia can fully support DPD.

If the remote peers are CheckPoint you can accomplish to use multiple interface for vpn that "Calculate IP based on network topology" options.

I would suggest you contact with TAC and get some enquiry.

Re: VPN Multiple interface interoperability device

Bac26 — Tue, 25 Oct 2022 07:56:26 GMT

so if set link selection that interface to intranet, internet vpn wont work right?