topic Re: VPN routing and External interfaces in Firewall and Security Management

VPN routing and External interfaces

AkosBakos — Thu, 19 Sep 2024 16:28:58 GMT

Dear CheckMates

I have a simple cluster with 5+ External interfaces. This cluster has 5+ s2s VPN communities. Depends on the routing the VPN's interoperable devices are behind different external interfaces. The essence of this, this cluster has more than 5 External interfaces.
The VPNs work fine.

Until today.

I created a s2s VPN as before.

Short description:

A_GW -> my_VPN_GW
B_VPN_peer -> peerGW
B_int -> peer interoperable device
B_enc -> network behind the peer (100.X.X.X/25 - yes it begins with 100)
A_int1 -> default route (this is the default route)
A_int2 -> the VPNpeer is behind this IF (from my_VPN_GW's point of view)

The issue:

The if I initiate for eg. a ping from my_VPN_GW to a host in the B_enc, the traffic leaves on the A_int1, although the B_VPN_peer is behind A_int_2 IF.

If I create a static-route -> the traffic goes where it should.

My question would be, this is a normal behavior if the ENC_DOM is not RFC1918?

Akos

Re: VPN routing and External interfaces

Lesley — Thu, 19 Sep 2024 18:23:54 GMT

Routing is not always needed but it is documented as needed.

See

https://support.checkpoint.com/results/sk/sk180613

And https://support.checkpoint.com/results/sk/sk179485

If it is vsx or maestro check https://support.checkpoint.com/results/sk/sk160672

https://support.checkpoint.com/results/sk/sk76281

All above is based that I think this is regarding domain based tunnels

Re: VPN routing and External interfaces

the_rock — Thu, 19 Sep 2024 19:50:06 GMT

Hey bro,

I would say its normal, regardless. I actually wrote some docs about it, you can refer to below post. I know its route based tunnel to Azure, but it gives you an idea.

Hope it helps.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Route-based-VPN-tunnel-to-Azure/m-p/206179/emcs_t/S2h8ZW1haWx8dG9waWNfc3Vic2NyaXB0aW9ufExTTjlYV1FXMUlGQVNMfDIwNjE3OXxTVUJTQ1JJUFRJT05TfGhL#M38950