topic Re: AWS VPN use Checkpoint like a Gateway to internet in General Topics

AWS VPN use Checkpoint like a Gateway to internet

jasr_eiffage — Tue, 21 Sep 2021 16:39:14 GMT

Hello everyone,

I have a VPN Site to Site tunnel between AWS and CKP, the tunnel works correctly with traffic between both subnets, the problem comes when trying to get the AWS machines to go out to the internet through CKP, I can't ping 8.8.8.8.8 for example, the trace stays on the private IP of the point to point adapter (169.254.72.110).

I have made the configurations as indicated in the guide, it is a static route VPN, in AWS I indicate that everything (0.0.0.0/0) goes through the virtual gateway of the VPN, as I indicate the tunnel works correctly since it does not have falls and in the case of internal traffic there is no problem.

Does anyone know where the error could be?

Re: AWS VPN use Checkpoint like a Gateway to internet

PhoneBoy — Thu, 23 Sep 2021 19:50:27 GMT

Which precise guide did you follow?
What precise version/JHF?
Did you create any NAT rules for the Internet-bound traffic?
I'm pretty sure you need to do this.

Re: AWS VPN use Checkpoint like a Gateway to internet

jasr_eiffage — Fri, 24 Sep 2021 10:46:40 GMT

Hi,

This guide: How to configure IPsec VPN tunnel between Check Point Security Gateway and Amazon Web Services VPC using static routes

Actually: R80.40 take 294

The NAT rules I have are the normal outgoing rules to the internet of the rest of the networks that pass through the CKP, would it be necessary to make a specific rule for the VPN?

Re: AWS VPN use Checkpoint like a Gateway to internet

PhoneBoy — Fri, 24 Sep 2021 22:45:47 GMT

FYI, "Take 294" isn't a valid JHF level, I believe you can get that from cpinfo -y.

Obviously, the VPN is working, so you don't need NAT rules specifically for that.
But clearly the traffic is not getting to the Internet and NAT is the likely issue.
Have you done a tcpdump on the Internet-facing interface to see if the traffic is actually being translated?

What are the precise NAT rules you have configured?
I presume one of them is a HIDE NAT rule where you are hiding behind the gateway/cluster.
What is the precise IP address of that object?
If it's a private IP address (versus the elastic IP), that's probably why it's not working.