topic Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router) in Firewall and Security Management

Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

LM-Rafael — Sun, 16 Feb 2025 22:21:16 GMT

Hi,

I want to connect a headquarters with a branch office using a site-to-site VPN.

Environment Details

Headquarters:

Device: Check Point 3600 running Gaia R81 (latest updates)
WAN: Two ISPs (WAN1 & WAN2) with static IPs, connected via VDSL dial-up modem
LAN: 192.168.88.0/24

Branch Office:

Device: Fritzbox (latest firmware) acting as the VPN server
WAN: Static IP
LAN: 192.168.89.0/24

Configuration Steps Taken

For the Check Point firewall, I followed:

(2110) Day-14 | IPSec VPN Configuration between Checkpoint and Fortigate Firewall - YouTube

For the Fritzbox setup, I used:

IPsec Site-to-Site VPN zwischen Sophos XG und Fritzbox konfigurieren - Orange-Fox
Fritzbox supported Vendor information about IPSEC VPN: FRITZ!Box mit einem Firmen-VPN (IPSec) verbinden | FRITZ!Box 7590

Issue Description

The VPN tunnel sometimes establishes successfully but only after 15–25 minutes. However, traffic is not being routed through the VPN tunnel.

I am unsure why the connection is unstable and why traffic is not passing through.

Request for Help

How can I ensure traffic is correctly routed through the VPN tunnel?
Are there specific settings I need to check on the Check Point firewall or the Fritzbox?

Thanks in advance for your support!

Best regards,
Rafael

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

the_rock — Sun, 16 Feb 2025 22:41:18 GMT

Hey Rafael,

We definitely need more info. Where does it fail? Phase 1 or 2? Any logs/debug messages? Route or domain based tunnel? Permanent or not?

To do debug on CP side, just run below:

vpn debug trunc

vpn debug ikeon

-try initiate traffic when its fialing

vpn debug ikeoff

Get iked and vpnd* from $FWDIR/log dir

HTH

Andy

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

LM-Rafael — Sun, 16 Feb 2025 22:58:15 GMT

Hi,

how can i export the files from shell?

Thanks

Rafael

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

the_rock — Sun, 16 Feb 2025 23:01:49 GMT

Most people just enable bin bash shell to do so. You can run chsh -s /bin/bash admin or whatever admin name is. If you wish to return to regular shell, just run same command but instead of /bin/bash, type /etc/cli.sh

Then, you can use winscp to navigate through the directories. Just type cd $FWDIR/log and then pwd to see it in "readable" format.

You can also change all this through web UI page under users.

Andy

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

LM-Rafael — Mon, 17 Feb 2025 05:29:20 GMT

Hi Rock,

here are the files.

Thanks

Rafael

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

the_rock — Sun, 16 Feb 2025 23:13:29 GMT

I will review. What is the peer IP? If you cant say it here, just message me directly.

Andy

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

the_rock — Sun, 16 Feb 2025 23:54:13 GMT

Here is all I keep seeing, but does not tell me much sadly. Where does it fail on CP? Phase 1 or 2?

Andy

RLL_Sync_ReSchedule: Failed to retieve interval value from parameter

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

the_rock — Mon, 17 Feb 2025 00:03:42 GMT

Btw, though its long weekend here in Canada where I live, so Monday we have off, but happy to do remote if you are okay with it. Not sure where you are, but Im in EST, which is GMT -5.

Let me know. I think once I can see the config, it would be much easier to try figure this out.

Andy

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

Chris_Atkinson — Mon, 17 Feb 2025 00:04:38 GMT

Be aware that R81 is EOL as at October 2024 so upgrading to e.g. R81.20 is recommended to engage support etc.

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

the_rock — Mon, 17 Feb 2025 00:19:18 GMT

Good point Chris.

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

LM-Rafael — Mon, 17 Feb 2025 05:31:35 GMT

Hi Chris,

R81.20 Jumbo Hotfix Take 92 is installed.

Thanks

Rafael

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

LM-Rafael — Mon, 17 Feb 2025 05:36:52 GMT

Hi Andy,

Have you more information for me that how can i extract the information?

Thanks

Rafael

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

LM-Rafael — Mon, 17 Feb 2025 05:41:26 GMT

Hi Andy,

I would be happy to suggest something. I'm happy to follow your lead. I am from GMT+1 Germany.

Thanks

Rafael

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

the_rock — Mon, 17 Feb 2025 12:14:19 GMT

If you are free say 6 pm your time, I can send link for the remote then, let me know.

Andy

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

the_rock — Mon, 17 Feb 2025 12:14:49 GMT

Sadly, not much more apart from what I sent.

Andy

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

the_rock — Mon, 17 Feb 2025 18:42:25 GMT

If you are around, let me know, Im free for remote.

Andy

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

LM-Rafael — Mon, 17 Feb 2025 18:46:48 GMT

Hi Andy,

Sorry, I just saw your message now. I’m available at 8 PM. Does that work for you? Which platform would you prefer for our discussion? Teams, TeamViewer, or something else?

Thanks

Rafael

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

the_rock — Mon, 17 Feb 2025 18:50:01 GMT

Usually, for these things, I use my personal zoom if you dont mind. Our corporate is teams, but my zoom, since its just via my gmail, its good for 40 mins free and then you need to wait 10 mins to have another 40 mins remote and so on, but Im sure 40 mins is more than enough 🙂

If 8p, is good for you, thats 11 more mins, let me have quick lunch and I will send you the link directly.

Best,

Andy

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

LM-Rafael — Mon, 17 Feb 2025 18:53:10 GMT

Yeah 8 pm is perfect. rafael@lema-it.de.

Re: Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

the_rock — Mon, 17 Feb 2025 18:55:13 GMT

Just sent it.