topic Re: VPN AWS - rules not matching in Firewall and Security Management

VPN AWS - rules not matching

dede79 — Tue, 18 Jun 2024 08:26:37 GMT

Hello,

I created a VPN to from onprem fw cluster to AWS gateway exactly like desribed in sk100726.

The VPN is up and I see tunneltest packets but the traffic does not match the outgoing rule with the directional match, runs to cleanup and is dropped. Selectig VPN any leads to an "accept" but not to encrypt.

Customer already have another working vpn to aws - actually no idea where to debug the rule match.

Re: VPN AWS - rules not matching

the_rock — Tue, 18 Jun 2024 12:48:35 GMT

Can you send the screenshot of the rule itself?

Andy

Re: VPN AWS - rules not matching

dede79 — Wed, 19 Jun 2024 06:07:43 GMT

Re: VPN AWS - rules not matching

the_rock — Wed, 19 Jun 2024 10:08:18 GMT

Thats why it fails. Check out my post below on what rule should look like, its in the attached doc.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Route-based-VPN-tunnel-to-Azure/m-p/206179/emcs_t/S2h8ZW1haWx8dG9waWNfc3Vic2NyaXB0aW9ufExTTjlYV1FXMUlGQVNMfDIwNjE3OXxTVUJTQ1JJUFRJT05TfGhL#M38950

Re: VPN AWS - rules not matching

the_rock — Wed, 19 Jun 2024 10:09:51 GMT

And if it hates you to read the doc (which I would not blame you for lol), then make sure vpn column is as below, 3 entries:

internal; clear - vpn communit

vpn community - internal clear

vpn community - vpn community

Push policy, test.

Andy

Re: VPN AWS - rules not matching

dede79 — Thu, 20 Jun 2024 06:54:37 GMT

Hi - your doc helped (peer name in tunnel interface was same as interopdevice but with 1 capital letters) but this should have nothing to do with the rule I posted...I had all the 3 relevant rules.

Re: VPN AWS - rules not matching

the_rock — Thu, 20 Jun 2024 10:50:13 GMT

Thats why I put my other reply, since I know most of us hate reading documentation, though my doc was short lol. Anyway, if you read it carefully, you would have seen I had in there EXACTLY what I posted after 🙂

Glad its working!

Andy