topic Re: Site to Site VPN terminate on firewall with no public ip address via external firewall in Firewall and Security Management

Site to Site VPN terminate on firewall with no public ip address via external firewall

TOM_MORAN — Wed, 11 Dec 2024 11:00:05 GMT

Hi I need to :

1) set up a VPN from AWS to a R81.20

the question is :

can i do a nat of a public ip address to the inner firewalls private ip address.

Using nat t will this allow me to terminate the VPN on the inner firewall & tunnel traffic using ipsec directly to inner ?

The network between the inner & outer are the same /24 network.

I will use sk100726

The documentation suggests this is achievable, has anyone done this ?

This will allow a significant simplification of routing changes on the internal lan that will be required.

any help is appreciated

Re: Site to Site VPN terminate on firewall with no public ip address via external firewall

the_rock — Wed, 11 Dec 2024 13:31:06 GMT

Im fairly sure it is possible, you would just need to do static nat in this case and make sure nat is NOT disabled inside vpn community.

Hey, do you have simple network diagram you can attach? I think that would help us as well.

Andy

Re: Site to Site VPN terminate on firewall with no public ip address via external firewall

TOM_MORAN — Wed, 11 Dec 2024 13:50:12 GMT

apologizes i thought i had attached the diagram

Re: Site to Site VPN terminate on firewall with no public ip address via external firewall

the_rock — Wed, 11 Dec 2024 13:56:03 GMT

Got it, yes, np man, we see it now! So essentially, just to make sure, S2S is between AWS and outer CP fw, but connection has to flow all the way to the server itself, which is behind INNER cp fw?

Andy

Re: Site to Site VPN terminate on firewall with no public ip address via external firewall

TOM_MORAN — Wed, 11 Dec 2024 14:10:16 GMT

Hi Andy many thanks.

Normally the VPN would terminate on the physical ip of the outer firewall.

But what i want to do is :

do a static nat public public ip on the outer fw to the inner fw & use that ip as the termination ip site.

If i do that can we tunnel traffic using nat t & ipsec to the inner fw

we don't want to route traffic on the outer fw

Re: Site to Site VPN terminate on firewall with no public ip address via external firewall

the_rock — Wed, 11 Dec 2024 14:15:37 GMT

K, thats more clear now. Good question actually...so you dont need S2S between outer and inner fw, just to forward it to inner?

Andy

Re: Site to Site VPN terminate on firewall with no public ip address via external firewall

TOM_MORAN — Wed, 11 Dec 2024 15:11:15 GMT

correct connect/forward to inner

Re: Site to Site VPN terminate on firewall with no public ip address via external firewall

the_rock — Wed, 11 Dec 2024 15:12:55 GMT

I would say as long as rules allow it and routing is there, no reason not to work, as technically, inner firewall would simply "serve" as passthrough (if you will) to reach the final destination.

Andy

Site to Site VPN terminate on firewall with no public ip address via external firewall

CheckMatesAI — Wed, 11 Dec 2024 20:51:38 GMT

This answer is provided by Infinity AI Copilot and should be confirmed by reviewing official documentation in Support Center.

Yes, you can set up a VPN from AWS to an R81.20 firewall without a public IP by using NAT to map a public IP to the inner firewall's private IP. Using NAT-T (NAT Traversal) will allow you to terminate the VPN on the inner firewall and tunnel traffic using IPsec directly to the inner firewall. This setup is supported and can simplify routing changes on your internal LAN.

Here are some key steps to consider:

NAT Configuration: Ensure that the public IP is properly NATed to the private IP of the inner firewall. This will allow the VPN traffic to reach the inner firewall.
NAT-T Configuration: Enable NAT Traversal on your VPN settings to handle the NATed traffic correctly.
VPN Configuration: Follow the guidelines in sk100726 for configuring IPsec VPN between your Check Point Security Gateway and AWS VPC using static routes and Numbered VTI.
Network Configuration: Since the network between the inner and outer firewalls is the same /24 network, ensure that routing and firewall rules are correctly set to allow traffic to flow between these networks.
Testing and Validation: After configuration, test the VPN connection to ensure that traffic is correctly routed and encrypted between AWS and your internal network.

This approach is feasible and has been documented in Check Point's resources, allowing for a streamlined setup. If you encounter any issues, consider revisiting the configuration steps or consulting with Check Point support for further assistance.