topic Re: BGP peer Throught IPSEC tunnel in Firewall and Security Management

BGP peer Throught IPSEC tunnel

Bernardes — Sun, 02 Apr 2023 17:36:39 GMT

Hello Mates!

I need to configure an iBGP peer where the peer is in the site-to-site tunnel. This environment is currently running on Fortinet Firewall and I need to migrate that from it to Check Point Firewall.

I made a lab to try to resolve this demand and when I try to put the peer up with the configuration inside the tunnel it doesn't work at all. Testing the out the tunnel, the peer goes up normally.

Does anybody know if it is possible or compatible with Check Point this iBGP inside IPSEC tunnel configuration?

Is there any specific configuration that I need to do to the peer goes up?

If you guys need prints from my configurations I can send it.

Thank you!

Re: BGP peer Throught IPSEC tunnel

HeikoAnkenbrand — Sun, 02 Apr 2023 19:38:12 GMT

Here is an example how this works with Azure.
Instead of Azure, this can also be any other VPN destination.

GAIA Web GUI

1) Create VPN Tunnel Interface (VTI)

NOTE:
THE PEER NAME MUST MATCH THE SMARTDASHBOARD OBJECT NAME OTHERWISE THE VTI WILL NOT WORK

2) Add Static Route for Azure VPN Peer BGP IP:

3) Setup BGP in GAIA WebUI

WARNING:
Without “ALL” of these configurations completed BGP will not be successful

4) Add Azure Gateway BGP Information:

Fill in information based on Azure Gateway BGP Settings:

NOTE:
Without Multihop enabled the BGP session will not be established

5) Set BGP Inbound route filters

NOTE:
For the purpose of this documentation the inbound filter has been set to accept all routes – this will vary in each environment

6) Set inbound route filter settings

SmartConsole

7) Create an empty VPN group which will represent the Azure VPN Gateway’s vpn domain:

8 ) Next create Azure VPN Gateway object:

9) Create VPN Community

10) Create VPN ruleset
...

Re: BGP peer Throught IPSEC tunnel

the_rock — Sun, 02 Apr 2023 22:28:37 GMT

Wow...the effort you put in your answer @HeikoAnkenbrand is truly outstanding!👌👌

Re: BGP peer Throught IPSEC tunnel

the_rock — Sun, 02 Apr 2023 22:30:08 GMT

@Bernardes ...just to add to what @HeikoAnkenbrand said, sometimes you may need to edit VTI in dashboard fw topology and possibly enable "dont check packets from.." to make this work 100%.

Just wanted to throw that out there...I had seen it few times, but not too too often.

Andy

Re: BGP peer Throught IPSEC tunnel

chueymtz — Fri, 26 Jan 2024 17:33:46 GMT

How would this be configured on a cluster? Great explanation by the way.

Re: BGP peer Throught IPSEC tunnel

the_rock — Fri, 26 Jan 2024 17:39:34 GMT

My colleague and I did this in the lab, ONLY way we could make it work with cluster and BGP was using UNNUMBERED vti.

Andy

Re: BGP peer Throught IPSEC tunnel

emmap — Mon, 29 Jan 2024 07:40:30 GMT

Each cluster member has its own VTI with IP Address, then you 'get' interfaces in smartconsole and create the VIP that the other end will talk to. Details are in the VPN admin guide.

Re: BGP peer Throught IPSEC tunnel

Matlu — Thu, 21 Aug 2025 18:09:25 GMT

Hello, @HeikoAnkenbrand
Is this the same process that must be followed in a VSX environment?
I have a VS where I currently have several S2S VPNs.
There is a need to “migrate” one of the traditional VPNs we have so that it now works using BGP.
So, are there many changes that would need to be considered to achieve this?
I understand that BGP in VSX is configured only by CLI, and that CLI is also where you have to work with VTIs?
Is there any documentation or post that talks about BGP over S2S VPNs in VSX environments?
Thanks for your comments.

Re: BGP peer Throught IPSEC tunnel

Chris_Atkinson — Thu, 21 Aug 2025 23:39:22 GMT

For some hints please see: https://community.checkpoint.com/t5/Security-Gateways/VPN-SITE-TO-SITE-CHECKPOINT-VSX-ROUTE-BASED/td-p/215791