topic Re: How to create a site-to-site VPN between two Check Point firewalls in General Topics

How to create a site-to-site VPN between two Check Point firewalls

SecdetKrypton — Tue, 08 Apr 2025 17:12:39 GMT

Hello, I want to create a site-to-site VPN between two Check Point firewalls, both with public IPs. If both firewalls are managed by the same management console, is there another method to establish the connection, or can I do it as if they were two independent Check Points? What would be the best method to create a site-to-site VPN in this case?

Re: How to create a site-to-site VPN between two Check Point firewalls

Tal_Paz-Fridman — Tue, 08 Apr 2025 18:06:11 GMT

If they are managed by the same Security Management Server it is as simple as adding them them to a VPN Community (and a couple of other steps...)

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SitetoSiteVPN_AdminGuide/Content/Topics-VPNSG/Getting-Started.htm

Re: How to create a site-to-site VPN between two Check Point firewalls

the_rock — Tue, 08 Apr 2025 18:21:23 GMT

Its pretty much what Tal sent.

Andy

Re: How to create a site-to-site VPN between two Check Point firewalls

SecdetKrypton — Tue, 08 Apr 2025 19:24:33 GMT

When creating the VPN community, it would be set up as a star, and both security gateways would be added as center gateways without a shared secret?

Re: How to create a site-to-site VPN between two Check Point firewalls

Tal_Paz-Fridman — Tue, 08 Apr 2025 20:05:44 GMT

The main difference between a Meshed and a Star VPN Community lies in their topology and the way VPN tunnels are established:

Meshed VPN Community:

In a Meshed community, there are VPN tunnels between each pair of Security Gateways. This means that every gateway can directly communicate with every other gateway in the community.
This setup is ideal for environments where all sites need to communicate with each other directly, providing a fully interconnected network

Star VPN Community:

In a Star community, each satellite Security Gateway has a VPN tunnel to the central Security Gateway, but not to other Security Gateways in the community.
This topology is suitable for scenarios where remote sites (satellites) need to communicate with a central site (hub) but not necessarily with each other.

Seems like in your case you need a simple Meshed VPN Community. No need for a dedicated shared secret since they are part of the same community (Shared Secret would be needed if the Security Gateways are not managed by the same Security Management Server)

Re: How to create a site-to-site VPN between two Check Point firewalls

the_rock — Tue, 08 Apr 2025 20:16:04 GMT

If its only 2 firewalls, I never found much difference, but as @Tal_Paz-Fridman indicated, those are main differences. You are correct, only if you indicate satellite gateway, then you need to enter shared secret, so just add both of them (if its 2) as center gateways.

Andy

Re: How to create a site-to-site VPN between two Check Point firewalls

SecdetKrypton — Tue, 08 Apr 2025 23:25:56 GMT

"Thank you for your explanation, it was very clear."

Re: How to create a site-to-site VPN between two Check Point firewalls

the_rock — Tue, 08 Apr 2025 23:50:55 GMT

To add to an excellent explanation Tal provided, hope below is useful too.

Andy

Meshed VPN (Full Mesh):

Connectivity:

Every site in the VPN has a direct, secure tunnel (VPN tunnel) to every other site.
Scalability:

While it offers high redundancy and fault tolerance, the number of tunnels grows exponentially with each added site, which can become complex to manage.
Performance:

A fully meshed topology allows for the highest performance, lowest transmission delay, and the best fault tolerance possible.
Use Cases:

Ideal for situations where all sites need to communicate directly with each other, such as a company with multiple offices that need to share data and resources freely.

Star VPN (Hub and Spoke):

Connectivity:

Satellite sites (spokes) connect only to a central site (hub), and satellite sites cannot directly communicate with each other.
Scalability:

Easier to manage than a mesh VPN, especially for large networks, as the number of tunnels grows linearly with the number of satellite sites.
Performance:

Traffic between satellite sites must go through the central hub, which can introduce some latency.
Use Cases:

Suitable for scenarios where communication between remote sites and a central office is needed, but not necessarily between the remote sites themselves, such as a company with remote offices and a main office.
Security:

If the central hub fails, all communication from hub to spokes and between spokes fails.

Re: How to create a site-to-site VPN between two Check Point firewalls

SecdetKrypton — Wed, 09 Apr 2025 04:01:25 GMT

Thank you very much for the explanation, it will be helpful.

Re: How to create a site-to-site VPN between two Check Point firewalls

the_rock — Wed, 09 Apr 2025 10:36:42 GMT

No problem, glad we can help.

Andy