topic Re: VPN over VPN in Firewall and Security Management

VPN over VPN

Artyom_Nikulin — Fri, 07 Dec 2018 06:05:39 GMT

Hi!

How can I do vpn tunnel inside another vpn tunnel (check point)?

Re: VPN over VPN

G_W_Albrecht — Fri, 07 Dec 2018 08:09:09 GMT

Between which peers do you want the VPN ? The CP VPN is created between two GWs and - apart from FW rules - transparent, so a client/server behind one GW can connect using VPN to a client/server behind the other GW.

Re: VPN over VPN

Artyom_Nikulin — Fri, 07 Dec 2018 15:19:26 GMT

A third-party VPN-client (not CP) is installed on the employee's PC. Also, a third-party VPN-client is installed on an employee’s PC at another office. It is necessary that third-party VPN traffic passes inside the CP VPN tunnel, created between two CP GWs (VPN inside VPN)

Re: VPN over VPN

AlexeyB — Mon, 10 Dec 2018 03:33:43 GMT

Scheme like this:

(user, want to OpenVPN server)-----"openVPN secured traffic"---->(CP GW)------"openVPN secured trafic encapsulated to IPSec"--------------------->(CP GW)------"decapsulated from IPSec openVPN secured traffic"----->(OpenVPN server)

If you control transport, for some reasons you may incapsulate "openVPN secured trafic encapsulated to IPSec" into GRE tunnel between transport routers (such as cisco). So you can have vpn-in-vpn-in-vpn. OpenVPN traffic inside CheckPoint's VPN and CheckPoint's VPN inside GRE tunnel. Also you may create IPSec vpn between CP and 3rd party hardware. You should show your "path" of traffic for better understanding situation.

For this minimal scheme, you must add user and server in vpn encryption domain on CP sides, add both CP into same VPN community. CP will create VPN between they and encrypt "openVPN traffic" between user and server