topic Re: How to pass Remote peer internet except lan traffic through Checkpoint. ? in Firewall and Security Management

How to pass Remote peer internet except lan traffic through Checkpoint. ?

Baasanjargal_Ts — Thu, 23 May 2019 09:05:54 GMT

Does it possible to HOST_B access to internet through Checkpoint firewall by using IPSEC vpn tunnel.?

If yes, how to configure this.

Re: How to pass Remote peer internet except lan traffic through Checkpoint. ?

PhoneBoy — Tue, 28 May 2019 13:47:45 GMT

You may be able to do it with a Route-based VPN (versus a Domain-based one).
That said, I've never personally tried it.

Re: How to pass Remote peer internet except lan traffic through Checkpoint. ?

G_W_Albrecht — Tue, 28 May 2019 14:00:49 GMT

Sound like Hub Mode - see sk101239: Routealltrafficfrom Remote Access clients, including internet traffic, through Security Gateway ! Internat networks can be excluded, see sk130832: "Do not routetrafficfor local network to the gateway" is grayed out on Endpoint Security Client

Re: How to pass Remote peer internet except lan traffic through Checkpoint. ?

PhoneBoy — Tue, 28 May 2019 14:08:04 GMT

Except this is a site-to-site VPN link, not Remote Access clients.

Re: How to pass Remote peer internet except lan traffic through Checkpoint. ?

G_W_Albrecht — Tue, 28 May 2019 14:26:21 GMT

Then we need to consult Site to Site VPN Administration Guide R80.20 p.72 :

Configuring VPN Routing in Domain Based VPN

Configure most common VPN routing scenarios through a VPN star community in SmartConsole.

You can only configure VPN routing between Security Gateways that belong to a VPN community.

Configuring VPN Routing for Security Gateways in SmartConsole

To configure a VPN Routing in a star community in SmartConsole:

1. On the Star Community window, in the:

a) Center Gateways section, select the Security Gateway that functions as the "Hub".

b) Satellite Gateways section, select Security Gateways as the "spokes", or satellites.

2. On the VPN Routing page, Enable VPN routing for satellites section, select one of these options:

• To center and to other Satellites through center - This allows connectivity between the Security Gateways, for example if the spoke Security Gateways have dynamically assigned IP addresses, and the Hub is a Security Gateway with a static IP address.

• To center, or through the center to other satellites, to internet and other VPN targets - This allows connectivity between the Security Gateways as well as the ability to inspect all communication passing through the Hub to the Internet.

3. Create an appropriate Access Control Policy rule. Remember: one rule must cover traffic in both directions.

4. NAT the satellite Security Gateways on the Hub if the Hub is used to route connections from Satellites to the Internet.