topic Re: Trouble shouting IPSEC VPN between checkpoint Fw 3600 and Microtik route in General Topics

Trouble shouting IPSEC VPN between checkpoint Fw 3600 and Microtik route

junior_kakou — Wed, 17 Jun 2026 12:41:00 GMT

Hello everyone.
I’ve been struggling with this architecture for a while now.

I have two MikroTik CCR2004 routers at each site: Site A (head office) and Site B (remote site). Both routers are placed in the DMZ of an Orange fibre box, as shown in the diagram. In addition, the head office is equipped with an up-to-date Check Point 3600 Gaia R82 firewall.
I have configured a site-to-site IPsec VPN between the head office and the remote site B. The IPsec tunnel is working correctly. The PCs at site A can ping both networks at site B (192.168.1.0/24 and 192.168.2.0/24) and are able to open web pages on the Cloud Key Gen1 at site B.
PCs at site (B) can ping the servers at site (A) but are unable to open web pages or connect via RDP to the Windows servers at site A.
When a PC at site B attempts to access a web page on the server located at site (A), it receives the following error

this is the checkpoint policies settings

NAT settings

Routes Settings

Topologies stettings

I would like you to help me configure the firewall correctly, if it isn’t already, so that the PC at Site B can open and access the resources on the servers at Site A.

thank

Re: Trouble shouting IPSEC VPN between checkpoint Fw 3600 and Microtik route

PhoneBoy — Wed, 17 Jun 2026 21:26:39 GMT

What does it show in the logs on the Check Point end when you attempt to access RDP?
What troubleshooting have you done on the Microtik side to understand what's going on?
I suspect you will need to review logs and do a packet capture to see if/how the Microtik is sending the packet to the RDP server.

Re: Trouble shouting IPSEC VPN between checkpoint Fw 3600 and Microtik route

Gennady — Thu, 18 Jun 2026 07:44:13 GMT

Good day!

There are a number of assumptions I may make based on provided information:

1. The only VPN on the path of the problematic connection is Site-to-Site VPN terminated on Micritic routers. The connection doesn't use RemoteAccess VPN mentioned in RoleBased access rules.

2. HTTPS traffic is not dropped by policy because "Empty Response" is still a response which would not be possible if the connection is dropped.

3. The point 2 suggests that 3-way-handshake was completed. However, the connection doesn't establish because some problem related to TLS handshake.

The best guess if we have VPN (transit) + TLS error is packet fragmentation. Please, check MSS settings on MikroTik side and ensure that it is configured to a proper value for your VPN tunnel settings. You can google for "MSS value calculator" to find a tool to get the values.

In addition, I 100% support the reply from PhoneBoy. An investigation is better to start from Log review.

Re: Trouble shouting IPSEC VPN between checkpoint Fw 3600 and Microtik route

junior_kakou — Thu, 18 Jun 2026 10:20:44 GMT

Hi PhoneBoy,

I've just run some pings, but I'll check the logs on both Microtik and Checkpoint's end. I'd like to know if my policies, NAT configuration, and topology configuration are correct on checkpoint

Re: Trouble shouting IPSEC VPN between checkpoint Fw 3600 and Microtik route

junior_kakou — Thu, 18 Jun 2026 10:23:41 GMT

Hi Gennady ,

yes, i made changes to the MSS settings on both routers. But i'll start again. thank you

Re: Trouble shouting IPSEC VPN between checkpoint Fw 3600 and Microtik route

PhoneBoy — Thu, 18 Jun 2026 18:37:33 GMT

The only thing I find "odd" in your configuration is using the gateway object setting for HIDE NAT (versus rules).
There's a setting in the VPN Community related to NAT also (disable NAT in VPN Community)...what is that set to?