topic Re: Ipsec VPN b/w checkpoint cluster and Azure gateway in General Topics

Ipsec VPN b/w checkpoint cluster and Azure gateway

Shivajith_S — Mon, 03 Sep 2018 07:44:26 GMT

Hi Experts ,

Does any one have config guide for Ipsec VPN config between Azure and my cluster gateway.

My requirement is to establish tunnel between CP Cluster gateway to Azure .

Thanks .

Re: Ipsec VPN b/w checkpoint cluster and Azure gateway

G_W_Albrecht — Mon, 03 Sep 2018 08:58:38 GMT

Please try sk101275: How to setup Site-to-Site VPN between Microsoft Azure and an on premise Check Point Security Gateway.

Re: Ipsec VPN b/w checkpoint cluster and Azure gateway

Shivajith_S — Mon, 03 Sep 2018 13:16:11 GMT

Azure is the gateway based ,so in Selected gateway option need select peer gateway or Local gateway (public IP)

And in do need to any changes in Left hand side corner option "gateway"

Its R80.1

Re: Ipsec VPN b/w checkpoint cluster and Azure gateway

Shivajith_S — Thu, 06 Sep 2018 16:34:39 GMT

Hi all ,

I have configured vpn community , for azure site to site vpn ,

But still have some issue , that from smart log once preshared key installed( key symbol ) getting rejected catogery in logs with mention IKE failure .

Not able to bring up tunnel .

And one more thing tried with permenant tunnel .

In azure they include Sadatasizekilobytes =102400000 kb for their ipsec profile,Do it's cause any issue ?For this failure .

Remaining encryption details configured same on both side.

Can any one have idea on this ???

Thanks.

Re: Ipsec VPN b/w checkpoint cluster and Azure gateway

G_W_Albrecht — Fri, 07 Sep 2018 07:17:50 GMT

I can only point to this: sk101275 How to setup Site-to-Site VPN between Microsoft Azure and an on premise Check Point Security Gateway ! Permanent tunnel is a CP feature only - with 3rd party, establish a client at one site that pings a client on the other side every now and then...

When you do a VPN / IKE Debug you should see which stage fails and why - if you can not explain the behaviour i would ask TAC for help.

Re: Ipsec VPN b/w checkpoint cluster and Azure gateway

Shivajith_S — Mon, 10 Sep 2018 15:12:29 GMT

Thanks Gunther for your kind support, This one solved.

Re: Ipsec VPN b/w checkpoint cluster and Azure gateway

Shivajith_S — Wed, 12 Sep 2018 11:23:37 GMT

Hi Gunther,

While monitoring the tunnel after brought it up ..It was broken not frequently only one time recently .After resetting remote site end it came up .Is there any ways to troubleshoot further .

Thanks.

Re: Ipsec VPN b/w checkpoint cluster and Azure gateway

G_W_Albrecht — Wed, 12 Sep 2018 11:36:38 GMT

You can analyze the logs to find the reason that the VPN went down (on both sides).

Re: Ipsec VPN b/w checkpoint cluster and Azure gateway

Peter_Kenda1 — Wed, 12 Dec 2018 16:57:53 GMT

Hello Günther,

Is there some information how to do Site to Site VPN connection to Azure with the SMB appliances. On the Microsoft site (About VPN devices for cross-premises Azure connections | Microsoft Docs ) I can read that the Minimum OS version for checkpoint is R77.30 on SMB appliances the latest version is R77.20.81. When I try to do VPN connection with R77.30 OS version (on 4600 appliances) the VPN work without any problem. Then I try with SMB appliances 1430 with the latest firmware/OS version R77.20.81 the VPN not work (with the same setting that I have for 4600 appliances).I would like to use RouteBased VPN connection with Azure.

When I try to do the VPN connection I can see that the Phase1 is up, but not Phase2. When I try to do the VPN debug I can not see anything in the ike.elg file. I check the ikev2.nmll file but looks like that I don't know how to read the file (ikeviewer).

Best regards, Peter

Re: Ipsec VPN b/w checkpoint cluster and Azure gateway

G_W_Albrecht — Thu, 13 Dec 2018 11:46:33 GMT

I would suggest to involve TAC and later post the results here!