topic Re: VPN node behind NAT in Firewall and Security Management

VPN node behind NAT

adamec — Tue, 14 Nov 2023 15:46:22 GMT

Hi guys,

I have a question about VPN ending behind NAT. We would like to use Route-based VPN. We have two remote sites each with its own management. On one site we have a CP appliance directly with its own public IP.

On the other side first there is edge router with its public IP lets say 1.2.3.4, this router is doing static NAT, behind this router there is a CP firewall which have IP statically NATed to lets say 10.10.10.10.

With route based VPN we created VTIs each with it's own IP attached to physical interface as stated in the documentation.

Route Based VPN (checkpoint.com)

You configure a local and remote IP address for each numbered VPN Tunnel Interface (VTI).

For each Security Gateway, you configure a local IP address, a remote address, and the local IP address source for outbound connections to the tunnel.

The remote IP address must be the local IP address on the remote peer Security Gateway.

More than one VTI can use the same IP Address, but they cannot use an existing physical interface IP address.

Now as the router is doing NAT to 10.10.10.10, how should I configure VPN on first site so it knows there is a NAT on remote site and to send traffic via VPN tunnel to public IP 1.2.3.4 and then 2.2.3.4 if both interfaces are on same physical interface?

thanks

Re: VPN node behind NAT

PhoneBoy — Wed, 15 Nov 2023 00:32:12 GMT

If the gateway is subject to NAT and initiating a VPN connection, Link Selection needs to be set to the correct IP.
See: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SitetoSiteVPN_AdminGuide/Topics-VPNSG/Link-Selection.htm

Re: VPN node behind NAT

adamec — Wed, 15 Nov 2023 08:31:17 GMT

Okay so In my case, based on the topology picture I attached to the post.

I should configure link selection on the GW that is not behind NAT, and I should put IP address of the NATed VTI to the field "statically NATed IP" or IP of physical interface or should I configure it on the device that is behind NAT?

thanks

Re: VPN node behind NAT

PhoneBoy — Wed, 15 Nov 2023 14:51:02 GMT

This needs to be configured on the device behind NAT.

Re: VPN node behind NAT

Bob_Zimmerman — Wed, 15 Nov 2023 15:33:47 GMT

Specifically, on the object for the device which is behind NAT. This configuration on the object tells the Check Point firewall which IP to use when trying to connect to that peer.