topic Re: R82 Site to Site VPN with third party Router in General Topics

R82 Site to Site VPN with third party Router

TINTIN8 — Wed, 05 Mar 2025 00:17:50 GMT

Hi Checkpoint Gurus

I'm trying to set up a site-to-site VPN with a third-party GW (Router). In the new R82, it looks like there is a feature called "Enhanced link selection."

In my GW object, I've defined the External interface as Enhanced Link Selection. But realistically, we don't know how third-party devices are configured. All we do is exchange the security parameters with the given IP address and accept the interesting traffic.

The problem is that I cannot set up my VPN community in Enhanced mode without defining an Enhanced link selection on the third-party object. This doesn't make sense.

The error message says, "The VPN Community is configured to use "Enhanced Link Selection. "At least one VPN peer does not have configured interfaces. You must configure Enhanced Link Selection Interfaces in each VPN peer object."

Please refer to the attached pictures.

We cannot define interface details on third-party objects, and it's not practical to ask our vendors for this information.

Your help is much appreciated!!!

Re: R82 Site to Site VPN with third party Router

the_rock — Wed, 05 Mar 2025 02:23:08 GMT

I did this in my R82 lab, will send you some screenshots tomorrow. Error is telling you that peer link selection is incorrect, thats why.

Andy

Re: R82 Site to Site VPN with third party Router

TINTIN8 — Wed, 05 Mar 2025 02:23:47 GMT

Thanks the_rock!!!

Re: R82 Site to Site VPN with third party Router

the_rock — Wed, 05 Mar 2025 02:25:22 GMT

Of course @TINTIN8

Re: R82 Site to Site VPN with third party Router

the_rock — Wed, 05 Mar 2025 13:14:01 GMT

Please see attached.

Andy

Re: R82 Site to Site VPN with third party Router

PhoneBoy — Wed, 05 Mar 2025 15:40:39 GMT

For interoperable objects, the interface name doesn't have to match what the remote end actually uses.
You can use something generic like eth0.
The important thing is that interfaces are defined with the correct IP addresses.

Re: R82 Site to Site VPN with third party Router

the_rock — Wed, 05 Mar 2025 16:41:39 GMT

@TINTIN8 Hopefully screenshots I sent are good enough, but if not, let me know.

Andy

Re: R82 Site to Site VPN with third party Router

TINTIN8 — Thu, 06 Mar 2025 10:31:48 GMT

Thank you soooo much!!! it worked!!!

Re: R82 Site to Site VPN with third party Router

the_rock — Thu, 06 Mar 2025 12:44:10 GMT

Glad we can help.

Andy