topic Re: StarLink IPSEC in Firewall and Security Management

StarLink IPSEC

Aleksander_Osma — Thu, 27 Jun 2024 14:50:15 GMT

Hi all!

Is it possible to create a VPN tunnel between sites using 2xCheckPoint verion R81.20 . ?

If so, and it worked, what steps should I take to set it up?

Thanks

Re: StarLink IPSEC

Chris_Atkinson — Thu, 27 Jun 2024 15:19:25 GMT

Likely depends on your Starlink service/subscription, otherwise it shouldn't be vastly different to any other CP VPN.

Re: StarLink IPSEC

Ben_Dunkley — Thu, 27 Jun 2024 16:11:35 GMT

Bear in mind that StarLink connections are usually on dynamic public IP addresses, and I have seen these change quite frequently (like multiple times per day), so that is likely to be an obstacle that needs dealing with.

Re: StarLink IPSEC

PhoneBoy — Thu, 27 Jun 2024 17:00:35 GMT

Not sure why Starlink is in the subject.
In any case, start with the official documentation: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Site-to-Site-VPN.htm

Re: StarLink IPSEC

Aleksander_Osma — Thu, 27 Jun 2024 17:30:18 GMT

Yes public ip change 5-6 times per day

I know fortigate Device work with cgnat StarLink , but i try use recomendation fortigate to use on CP

but only get

Quick Mode Sent Notification: no subnet support in ike negotiations

Re: StarLink IPSEC

PhoneBoy — Fri, 28 Jun 2024 17:11:44 GMT

https://support.checkpoint.com/results/sk/sk181787 indicates a configuration issue (specifically the encryption domain).
Please detail the exact configuration steps you've taken as well as provide a simple network diagram.

Re: StarLink IPSEC

Lesley — Fri, 28 Jun 2024 20:14:45 GMT

This error sounds like you have to change the settings in the VPN community from subnet to gateway (third option is host)

Re: StarLink IPSEC

PhoneBoy — Fri, 28 Jun 2024 20:21:35 GMT

Which is configured in the relevant VPN community:

Re: StarLink IPSEC

Aleksander_Osma — Mon, 01 Jul 2024 08:03:37 GMT

I try change settings but not help me. Now i collect debug information