topic Re: BGP over VPN between Azure.docx in Firewall and Security Management

BGP over VPN between Azure.docx

Juan_Concepcion — Mon, 25 Sep 2017 13:44:30 GMT

Documentation which explains how to deploy a site to site VPN between an Azure VPN Gateway and Check Point R80.10 Gateway with BGP routing exchange via route based vpn.

Re: BGP over VPN between Azure.docx

Raphael_Cote — Tue, 14 Nov 2017 13:31:17 GMT

I've read that VTI is not supported in VSX mode. Can I follow this procedure in VSX mode?

Re: BGP over VPN between Azure.docx

Peter_Sandkuijl — Tue, 28 Nov 2017 10:34:38 GMT

Sorry, vti and VSX still don't work together

Re: BGP over VPN between Azure.docx

Timothy_Hall — Tue, 28 Nov 2017 13:17:29 GMT

Confirmed, and I suspect the reason for this limitation is that VTI's are implemented by a completely separate kernel module called vpntmod. VSX runs pretty much completely in process space.

Re: BGP over VPN between Azure.docx

Jose_W__Castill — Wed, 20 Dec 2017 14:36:09 GMT

Hi, I have a R80.10 Management and a cluster gateway R77.30. Can I follow this procedure? any aditional advice?

Re: BGP over VPN between Azure.docx

Juan_Concepcion — Wed, 20 Dec 2017 17:01:55 GMT

Yes

Sent from my iPhone

Re: BGP over VPN between Azure.docx

PAUL_SAMWAYS1 — Mon, 19 Feb 2018 14:14:47 GMT

Hi All, I've been trying to setup VPN to Azure with BGP (I've had no problems setting up standard VPN to Azure but require BGP for dynamic routing and thus bigger VPN to Azure, as we don't want to by an Express Route). I don't understand what this is trying to say in the document;

Re: BGP over VPN between Azure.docx

Juan_Concepcion — Mon, 19 Feb 2018 20:07:38 GMT

For the Azure gateway object you have to manually set the topology (on normal gateway you just fetch) and the encryption domain.

Let me know if this isn’t clear.

Sent from my iPhone

Re: BGP over VPN between Azure.docx

Ping_Choi — Thu, 30 Jan 2020 16:57:18 GMT

Hi Juan,

Would you happen to know if these steps also apply to Checkpoint R80.30 ?

Re: BGP over VPN between Azure.docx

RZomerman — Wed, 05 Feb 2020 13:48:38 GMT

Sorry to come back to this one..

On the "Interoperable Device" shouldnt the topology be the "External IP of the Azure GW" & the Azure VNET Address Space?

Why would i need to set my own CP External IP + Internal Subnet (on CP side) on the Interoperable Device referencing Azure?

Re: BGP over VPN between Azure.docx

Juan_Concepcion — Mon, 11 May 2020 19:52:42 GMT

No, in R80.30 I was able to do this without setting topology.

Re: BGP over VPN between Azure.docx

MCS_LTD — Thu, 05 Nov 2020 21:55:27 GMT

Is there an updated guide for this? I find the steps required for the Checkpoint to be incredibly hard to follow

Re: BGP over VPN between Azure.docx

Reyman2021 — Sun, 17 Jan 2021 09:13:21 GMT

Hi Juan,

The external IP you put here in the topology is different from the real IP of peer gateway? The VPN Peer gateway is 52.225.225.207 and the external IP in the topology is 52.184.160.26. On the other hard I would also

Re: BGP over VPN between Azure.docx

Reyman2021 — Sun, 17 Jan 2021 09:15:36 GMT

Hi Juan,

Re: BGP over VPN between Azure.docx

Juan_Concepcion — Sun, 17 Jan 2021 09:57:34 GMT

Can you please be more specific on which portion your having problems understanding??

Re: BGP over VPN between Azure.docx

Juan_Concepcion — Sun, 17 Jan 2021 09:59:57 GMT

This should match whatever ip address is on the azure vpn gateway. Oversite in transcription as I rebuilt this several times during documentation build and with each rebuild the ip was different.

Re: BGP over VPN between Azure.docx

Reyman2021 — Mon, 18 Jan 2021 05:20:43 GMT

Okay. By the way where do I get the router-id?

Re: BGP over VPN between Azure.docx

Mark_Bayley — Mon, 18 Oct 2021 13:28:59 GMT

hi,

Can I ask why your local address in the VPN tunnel config is 50.50.50.1? Shouldn't that be a 169.254.0.0/16 address?

Re: BGP over VPN between Azure.docx

hemh — Wed, 23 Aug 2023 20:38:56 GMT

Hi, on my side I struggled a lot to get the BGP peering stably, IPSec tunne is working A1 though. I have a generic Azure VPN GW and firewall. So to make it work with an on prem checkpoint cluster, on each cluster member I configured my cluster VTI Vip as router ID. Azure Local network gateways(one for each ISP as I am dual ISP) are pointing to my VTI cluster Vip also. Since then, everything is working fine