topic Re: Question in Site 2 Site VPN with Fortigate in Firewall and Security Management

Question in Site 2 Site VPN with Fortigate

BlueGrass — Wed, 29 Apr 2020 12:00:32 GMT

Hello ~

I just build up a VPN between Fortigate and CheckPoint.

I can ping from the Fortigate client side.

But When ping from Checkpoint client side, I find below error log:

Might I have some tips on it?

Re: Question in Site 2 Site VPN with Fortigate

Timothy_Hall — Wed, 29 Apr 2020 13:27:38 GMT

The Fortigate will silently drop your Phase 2 proposal if the Proxy-IDs (subnets) proposed by the Check Point do not exactly match the configuration on the Fortigate. When the Fortigate initiates, its Phase 2 proposal will be accepted by the Check Point even if it doesn't match the VPN domain subnets exactly. See scenario 1 of this SK for the solution: sk108600: VPN Site-to-Site with 3rd party

In R80.40+ you can customize the VPN domains per VPN Community in the SmartConsole to send the exact Phase 2 Proxy-IDs the Fortigate is expecting, without having to hack the user.def file as described above.

Re: Question in Site 2 Site VPN with Fortigate

BlueGrass — Wed, 29 Apr 2020 13:32:05 GMT

Thanks!

Might I know If can I keep Fortigate using 0.0.0.0/0.0.0.0 for Phrase 2 but use Static Route on CP to let traffic pass through my expected route to a VPN tunnel?

Re: Question in Site 2 Site VPN with Fortigate

Timothy_Hall — Wed, 29 Apr 2020 16:17:41 GMT

If the Fortigate is proposing a universal tunnel (0.0.0.0/0's) it may be using a route-based VPN. Setting VPN Tunnel Sharing to "one tunnel per gateway pair" on the Check Point should get things working as far as the Phase 2 negotiation. Are you using VPN domains or routes on the Check Point side to determine which traffic needs to enter the VPN tunnel? (i.e. "interesting" traffic)