topic Re: VPN Site to Site in Firewall and Security Management

VPN Site to Site

handiansudianto — Tue, 20 Feb 2024 03:26:51 GMT

Hello,

I build VPN site to Site to our vendor, and for local subnet/host they use public ip let say 15.15.15.15, actually they talk the ip 15.15.15.15 is in they internal network.

Now the site to site already configure from my end on checkpoint, and from my internal server when i try ping to 15.15.15.15 the CP route this traffic to the internet and not to the tunnel.

So i want to know can we monitor if we have multiple site to site tunnel, which one is up and which one is down?

Also, there are possibility the traffic routed to the internet because from other side (vendor) have wrong configuration or not permit our internal server to access to 15.15.15.15 or by default the checkpoint will route all destination which use public ip to internet?

Re: VPN Site to Site

AmirArama — Tue, 20 Feb 2024 13:54:41 GMT

Hi,

please mention which platform and OS version you are running, and is it centrally or locally managed.

did you configure 15.15.15.15 in the vpn domain of the vpn peer object (network>vpn domain) ?

do you see 15.15.15.15 running the command: fw tab -t vpn_routing -u -f ?

to display VPN tunnels, you can run 'vpn tu' (then use 1/2) or vpn tu tlist command

Re: VPN Site to Site

the_rock — Tue, 20 Feb 2024 17:05:35 GMT

To me, just logically thinking about it after I read your post, sounds like a routing issue. Can you verify what route its taking when you try reach the IP on the other side?

Best,

Andy

Re: VPN Site to Site

the_rock — Tue, 20 Feb 2024 17:23:41 GMT

Thanks for that command fw tab -t vpn_routing -u -f @AmirArama , never knew of it, super useful.

Best,

Andy