topic Re: Multiple Satelitte Gateways - VPN Setup in General Topics

Multiple Satelitte Gateways - VPN Setup

beneaton — Thu, 13 Feb 2020 11:44:22 GMT

Hi all,

Could anyone help me out at all? Even if there's a guide I've missed, or a CheckMates post already on this (I did search, but only found some questions vaguely similar) that'd be great.

I am wanting to setup 2 VPN Tunnels/1 Community
A Side (Me) - Check Point Sec GW R80.10
B Side - 2 x AWS Cloud GWs

We've had "Tunnel 1" setup already, and when we put traffic through it, it did work. So that should be fine.
Struggling with how to setup "Tunnel 2".

The only differences between Tunnel 1 and Tunnel 2:
IPs are not the IPs in use, just examples which reflect the same scenario -

T1:
Outside Customer GW: 28.226.247.191
Outside Virtual GW: 28.200.211.101
Inside Customer GW: 159.254.87.40/30
Inside Virtual GW: 159.254.87.39/30
Next Hop: 159.254.87.39
T2:
Outside Customer GW: 28.226.147.191
Outside Virtual GW: 28.203.110.6
Inside Customer GW: 159.254.184.96/30
Inside Virtual GW: 159.254.184.95/30
Next Hop: 159.254.184.95

So a Star Community?
Center - My Cluster object
Satelittes - Both Interoperable devices?
Tunnel - Per subnet pair or Per gateway pair?
VPN Routing - Center only?

In the Interoperable device -
IP: Outside Virtual Private Gateway IP?
Topology: Manually defined ENC domain (group to be empty?)

I appreciate any input in advance.

Thanks,
Ben

Re: Multiple Satelitte Gateways - VPN Setup

Maarten_Sjouw — Thu, 13 Feb 2020 11:48:28 GMT

First and foremost important question: Is this Route based VPN where Tunnel 2 is the backup to Tunnel1?

Re: Multiple Satelitte Gateways - VPN Setup

beneaton — Thu, 13 Feb 2020 11:50:29 GMT

Hi Maarten,

Sorry yes, the 2nd tunnel is to be used for redundancy.

Thanks

Re: Multiple Satelitte Gateways - VPN Setup

_Val_ — Thu, 13 Feb 2020 11:51:41 GMT

Hi,

it depends on your needs. You can either do two communities, or a single star with your physical cluster in the center and some optional VPN routing between satellites. Center only means traffic between satellites will not be passing through.

Use per par of GWs, as recommended here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113561&partition=Advanced&product=IPSec

Re: Multiple Satelitte Gateways - VPN Setup

_Val_ — Thu, 13 Feb 2020 11:53:03 GMT

Uh, that changes things a bit. Look here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108958

Re: Multiple Satelitte Gateways - VPN Setup

beneaton — Thu, 13 Feb 2020 12:20:11 GMT

That guide looks comprehensive, and mentions Tunnel 1 / Tunnel 2 - It does advise how to setup BGP, which was another question I had whether BGP was needed or not. Happy to try this. Thank you very much!