topic Re: 0/0 over a VTI config - Spark in General Topics

0/0 over a VTI config - Spark

isuckatthis — Thu, 19 Dec 2024 15:59:39 GMT

I'm pulling my hair out trying to configure a 0/0 over a VTI. We want to tunnel all traffic back to the headend.

There is some default route that is automatically added to the routing table based on the Internet. I don't want that. I need that gone. I've created /32s for what I need. All other traffic not identified in my host routes needs to route across the VTI.

How do I do this?

Re: 0/0 over a VTI config - Spark

PhoneBoy — Thu, 19 Dec 2024 21:26:08 GMT

Have you configured the relevant VPN site as "Route All Traffic"?
Believe that is required in this case.

Re: 0/0 over a VTI config - Spark

isuckatthis — Thu, 19 Dec 2024 23:23:07 GMT

Thanks PhoneBoy, I'll take a look at that. Is that in the VPN community inside SMS? I think I managed to make it work...

I created a route: Dst: Any Src: 192.168.10.0/24 Next Hop: remote side tunnel IP

I tried that previously but it didn't appear to be working, appears to be working now.

Re: 0/0 over a VTI config - Spark

PhoneBoy — Thu, 19 Dec 2024 23:43:02 GMT

Yes, you need to enable "Route All Traffic" in the relevant VPN Community in this case.

Re: 0/0 over a VTI config - Spark

the_rock — Fri, 20 Dec 2024 02:02:38 GMT

No sweat, we are all here to help. Im not an SMB expert, but what Phoneboy said makes perfect sense. Btw, have a look at the post I made for rouyte based tunnels and even though its on regular Gaia, it will give you some idea on how this is supposed to function.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Route-based-VPN-tunnel-to-Azure/m-p/206179/emcs_t/S2h8ZW1haWx8dG9waWNfc3Vic2NyaXB0aW9ufExTTjlYV1FXMUlGQVNMfDIwNjE3OXxTVUJTQ1JJUFRJT05TfGhL#M38950