topic Re: How to configure VPN IPSEC Site-to-Site with multiple Virtual IPs? in General Topics

How to configure VPN IPSEC Site-to-Site with multiple Virtual IPs?

Bernardes — Tue, 29 Nov 2022 15:13:55 GMT

Hello Mates!

Let me explain the scenario... We have a big customer that has a cloudguard cluster. This cluster is behind of an OCI (Oracle Cloud Infrastructure) . This OCI manage IPs from public to private and the gateway just see the private IPs.

My gateway interfaces is like this:

This customer has many ranges of public IPs, so that each peer partner will use one of these public IPs to establish the VPN tunnel.

My doubt is: How can I configure all these IPs on the CP side so that it can respond for all partners, each one with a different IP?

Normally, in the VPN link selection, we set an IP that will respond to all partners.

Is it supported on Check Point?

Any advice?

Thank you!

Re: How to configure VPN IPSEC Site-to-Site with multiple Virtual IPs?

PhoneBoy — Tue, 29 Nov 2022 20:41:11 GMT

Can you directly specify what peer uses what IP for Link Selection? No.
It would have to be done with routing, which given this scenario, may not be an option.

Re: How to configure VPN IPSEC Site-to-Site with multiple Virtual IPs?

Bernardes — Tue, 29 Nov 2022 22:52:27 GMT

Hello @PhoneBoy . How could I use routing to make this?

I try to search for any documentation to help me with this configuration, but I guess that I'm not searching for the right keywords.

Have any way to make this work?

Re: How to configure VPN IPSEC Site-to-Site with multiple Virtual IPs?

PhoneBoy — Wed, 30 Nov 2022 02:36:22 GMT

You can read all about Link Selection here: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SitetoSiteVPN_AdminGuide/Content/Topics-VPNSG/Link-Selection.htm?tocpath=Link%20Selection%7C_____0#Link_Selection

A routing configuration would assume that the public IPs were available on the interface the traffic is routed out.
Since everything on your gateways is private IPs, this will most definitely not work since the gateway won’t know what the public IP is on that interface.