topic Site2Site-VPN not working with VLANS/additional IP-nets? in Firewall and Security Management

Site2Site-VPN not working with VLANS/additional IP-nets?

Albin_Petersson — Tue, 18 Jul 2023 16:35:02 GMT

Helloes.

Unsure what the problem is here, and I'm not that good at checkpoint VPN:s.

We have a 7000 gateway at our main site and some time ago we bought a smaller spark 1570 gateway for a remote location. We set up a S2S-VPN between these with 1 network on the remote site, and that seems to work fine. The network is added to LAN1 directly (and the tunnel runs over WAN)

Now i wanted to add 2 more networks to the remote site. We installed a switch, added a trunk between the 1570 and the switch, made VLAN interfaces on LAN2 (LAN2.1365 etc) with 2 VLAN:s. One VLAN has an SVI in the switch that I can ping from the 1570, the other doesn't but it has a camera attached that I can ping. So that part seems to be working as it should. But I cannot get traffic to use the S2S-VPN for these 2 VLAN-networks.

If I do traceroute from my office-PC to the 1st network, i can see that it uses the tunnel and i can also see in the CP logs that it is encrypting traffic etc.

If I do traceroute to network 2 or 3, I can see that the traffic goes out on the default GW and is not tunneled. There's no encryption in the checkpoint logs.

Looking at the remote GW-object in SmartConsole, the 3 networks show up as they should and are configured the same, just different IP:s.

the VPN object has the setting that VPN domain is all IP:s behind GW based on topology.

How do I troubleshoot this? Is it not possible to use VLAN:s?

Re: Site2Site-VPN not working with VLANS/additional IP-nets?

PhoneBoy — Tue, 18 Jul 2023 20:56:57 GMT

Did you change the Encryption Domain associated with the SMB device to include the new VLANs AND push policy to all relevant gateways?

Re: Site2Site-VPN not working with VLANS/additional IP-nets?

Albin_Petersson — Wed, 19 Jul 2023 04:37:44 GMT

well, the VPN domain is the same thing as encryption domain right? If it is set to use all IP:s behind the SMB device then shouldn't they update automatically?

I've pushed the policy to both gateways.

I tried to make a network group object now with the networks included and use that as VPN domain instead, but there's no difference.

Re: Site2Site-VPN not working with VLANS/additional IP-nets?

Albin_Petersson — Wed, 19 Jul 2023 04:51:17 GMT

hmm, I think I figured it out now. The ideas I had on how to add these new networks to the policies was wrong. It was never a problem with the VPN tunnel per se. I used the "remote" networks in the local GW:s policies, but that doesn't work apparently.

It's a bit confusing that it didn't work, but at least now the access works so that's all that matters.