topic Re: Originate an iBGP network for VPN pool? in Firewall and Security Management

Originate an iBGP network for VPN pool?

David_Herselman — Sun, 02 Aug 2020 11:21:12 GMT

Hi,

We're happily using Check Point VPN by allocating IPs from a network object, lets say 192.168.50.0/24. We have BGP peering with another network that doesn't use us as a default gateway and need to subsequently originate the VPN pool subnet.

Loading a black hole route however results in all traffic being rejected, presumably due to the stack running packets through the routing stack prior to inspection?

Loading a static route and pointing it at the loopback adapter however also doesn't work.

There also doesn't appear to be a bgp 'network' command whereby I could advertise a prefix without having the prefix in my routing table.

How do I proceed with this?

Regards

David Herselman

Re: Originate an iBGP network for VPN pool?

Chris_Atkinson — Mon, 03 Aug 2020 04:53:32 GMT

I've seen other environments where they achieved similar by routing the subnet out the external interface which is ultimately the origin interface for the VPN connections.

sk165333 provides scenarios relevant to NAT pools but the traffic may be handled differently (in the case of VPN) hence in R81 we have:

"IPv4 NAT-pool routes - Configuring and redistributing NAT-pool routes to routing protocols."

Re: Originate an iBGP network for VPN pool?

David_Herselman — Mon, 03 Aug 2020 23:38:28 GMT

Redistributing the static route whereby the gateway points upstream works perfectly.

Many thanks!