topic Re: Checkpoint connectivity between management & gateway over vpn in Firewall and Security Management

Checkpoint connectivity between management & gateway over vpn

AnkitBhandari — Wed, 19 Feb 2025 10:29:49 GMT

Hi Friends,

I am facing a issue that we got a project to replace the existing check point firewall and place the new check point but check point management is on Delhi and check point getaway is on Pune. Exiting was ipsec connectivity between gateway and management so how will I replace the Exiting firewall without or without snapshot backup?

Re: Checkpoint connectivity between management & gateway over vpn

PhoneBoy — Wed, 19 Feb 2025 16:14:40 GMT

More details about the existing environment are needed:

Appliances and Software versions used currently (version/JHF levels)
Appliances you are adding/replacing
A simple network diagram showing all components
Confirming someone didn’t disable the various implied rules to force management traffic through VPN (easy enough to see with a tcpdump on the external interface when, say, pushing policy or when the remote gateway sends logs).

Re: Checkpoint connectivity between management & gateway over vpn

the_rock — Thu, 20 Feb 2025 04:12:52 GMT

In case like that, I would get show configuration fdrom existing gateway and copy "bits and pieces" to new fw clish config, as long as you make sure relevant interfaces match. Unless its same hardware, backup/restore method would not sadly work.

Otherwise, you could technically try below method, though it was written for a cluster, but I did use it for single appliances as well.

Andy

Solved: Re: Replace/Upgrade Cluster - Check Point CheckMates

Re: Checkpoint connectivity between management & gateway over vpn

AnkitBhandari — Thu, 20 Feb 2025 04:24:51 GMT

Hi PhoneBoy,

Thanks for your reply , so senerio is simple that we have management in different location and gateway in other location they are working 81.10 version and we have to add the gateway with management checkpoint through ipsec.

Re: Checkpoint connectivity between management & gateway over vpn

PhoneBoy — Thu, 20 Feb 2025 12:48:12 GMT

Putting management traffic (which is already encrypted, FYI) through a VPN is not recommended as it requires editing implied rules and you can end up in a situation where it is impossible to manage your remote gateway if the VPN is down.
The official procedure for doing this is in an internal SK (sk115215) that requires consultation with TAC.

See also these public threads on CheckMates:

Re: Checkpoint connectivity between management & gateway over vpn

the_rock — Thu, 20 Feb 2025 12:52:29 GMT

I definitely misunderstood your question. Yes, what Phoneboy said is 100% correct.

Andy