topic Re: VSX and routebased VPN (Azure) in Firewall and Security Management

VSX and routebased VPN (Azure)

Wesley_van_der_ — Thu, 11 May 2023 14:28:31 GMT

Hi,

A nice new feature in VSX R81 is that we can create vpnt interfaces on a virtual firewall, using vsx_provisioning_tool on the SMS/MDS. We have a VSX setup with SMS, running both on R81.10 with JHF take 87.

We want to setup a new S2S VPN (routebased) with Azure. I managed to do that using sk176249.

Now the tunnel is up (phase 1 and 2) and BGP traffic from azure arives at our firewall. We will use BGP over the tunnel and now I am facing 2 different issues causing the BGP peer in active state instead of established.

1) BGP traffic from azure arives at our firewall, but is dropped with the reason "According to the policy the packet should not have been decrypted"

Normally with a policy based VPN, the VPN domains is the first thing I look at. But now we do use routed based and I have configured empty VPN domains as mentoined in the sk.

There is a route for the BGP peer in Azure (connected to vpnt interface).

2) BGP traffic initiated from our firewall, uses a funny ip as its source ip.

This traffic was first dropped ofcourse on our firewall since the rule I created uses the expected source ip. I tried to accept the traffic and use source NAT for this specifc traffic. Now the traffic is accepted, but not encrypted and routed over the tunnel.

Any tips to troubleshoot any further are welcome.

Re: VSX and routebased VPN (Azure)

PhoneBoy — Thu, 11 May 2023 19:31:46 GMT

Are you using a configuration similar to: https://support.checkpoint.com/results/sk/sk176249 ?

Re: VSX and routebased VPN (Azure)

Wesley_van_der_ — Mon, 15 May 2023 06:39:51 GMT

Yes. I used the sk to configure the VPN.

Re: VSX and routebased VPN (Azure)

PhoneBoy — Mon, 15 May 2023 21:34:37 GMT

Recommend a TAC case here to investigate: https://help.checkpoint.com

Re: VSX and routebased VPN (Azure)

Wesley_van_der_ — Wed, 24 May 2023 12:04:04 GMT

The first problem was solved by changing the alias of the vpnt interfaces. The alias of the interface needs to be exactly the same as the name of the interopable device object where this interface will be used for.

The second problem is solved by using NAT with the correct vpnt interfaces.