topic Re: Site to Site VPN between Check Point and Cradlepoint in Firewall and Security Management

Site to Site VPN between Check Point and Cradlepoint

Kevin_Orrison — Fri, 17 Jul 2020 21:59:34 GMT

Has anyone done a site to site VPN between a Check Point (DC) and Cradlepoint (remote) appliance? If so, I was just looking for feedback, steps taken, and things to look out for. Even better if it was accomplished using a dynamic IP on the Cradlepoint end.

Re: Site to Site VPN between Check Point and Cradlepoint

HeikoAnkenbrand — Sat, 18 Jul 2020 05:03:33 GMT

Hi @Kevin_Orrison

Take a look at this sk, it might help you:

sk53980: How to set up a Site-to-Site VPN with a 3rd-party remote gateway
sk108600: VPN Site-to-Site with 3rd party

Re: Site to Site VPN between Check Point and Cradlepoint

Kevin_Orrison — Mon, 20 Jul 2020 15:54:52 GMT

Thanks, that is helpful! The remote side will need to be a dynamic external IP. I seem to recall reading somewhere that you have to do a cert instead of a PSK for dynamic. Is that the case, and any input on how to do that?

Re: Site to Site VPN between Check Point and Cradlepoint

Timothy_Hall — Mon, 20 Jul 2020 17:56:56 GMT

You are correct, for a dynamic peer a cert is required along with the use of 3 packet Aggressive Mode instead of the more commonly-used 6 packet Main Mode exchange for IKEv1. Can't recall ever doing a dynamic peer VPN with IKEv2 but it may be more flexible in this case, although interoperability between different vendors using IKEv2 is still a bit spotty right now. See the following SK for links to an example configuration:

sk36968 - S2S VPN between Check Point Security gateway and Cisco DAIP