topic Re: VPN Site-to-Site Peer Route All Traffic Through Check Point in Firewall and Security Management

VPN Site-to-Site Peer Route All Traffic Through Check Point

Bernardes — Tue, 06 Jun 2023 19:27:55 GMT

Dear friends,

could you please help me with the following situation:

I am going to establish a tunnel between Site A (Check Point) and Site B (SonicWall), and I need all traffic, including internet browsing from Site B, to pass through Site A.

What is the best option to achieve this?

How should I configure the VPN Domains at gateways options on Sites A and B?

Re: VPN Site-to-Site Peer Route All Traffic Through Check Point

PhoneBoy — Tue, 06 Jun 2023 20:24:45 GMT

In a "route all traffic" scenario, you have to do one of two things:

Use Route-Based VPN (where the encryption domains are empty or 0.0.0.0/0), everything is controlled through the routing table.
In the relevant VPN community, ensure "One Tunnel Per Gateway Pair" is selected, which I believe means we will negotiate a 0.0.0.0/0 SA with the VPN peer:

If using domain-based VPN, on the Check Point side, your encryption domain would include the hosts behind it and you define the remote encryption domain as the hosts behind the remote gateway.
Can't speak to the Sonicwall side of the configuration in either case.

Re: VPN Site-to-Site Peer Route All Traffic Through Check Point

Blason_R — Wed, 07 Jun 2023 02:51:43 GMT

This is absolutely correct and you must go with route based VPN.