topic Re: Remote Access VPN on Gateways behind another firewall in SASE and Remote Access

Remote Access VPN on Gateways behind another firewall

OmarDafiri — Thu, 01 Jun 2023 21:39:44 GMT

Hello everyone,

I have a setup which is the following:

Two SG R81.10 on High Availability Mode.
External IP addresses are private IP's 10.11.103.245 and 10.11.103.246 and the VIP is 10.11.103.1.

The ISP router is connected to another firewall (Fortigate) which routes traffic to the VIP (10.11.103.1).

My default route is 10.11.103.254 (which is the Fortigate private interface IP address), the internet access works perfectly.

My concern is to setup a Remote VPN access using the public IP address. Is Statically NATed IP address is the best option I have under Link Selection configuration ? (I have tried it but the VPN lient doesn't recognize the site ), or there is another option for me I can use to configure it?

Thank you in advance

Re: Remote Access VPN on Gateways behind another firewall

PhoneBoy — Thu, 01 Jun 2023 22:18:36 GMT

Link Selection to a static IP (the public NAT) is the correct configuration.
Have you done any packet captures to confirm the Fortinet box is forwarding all the relevant traffic to the Check Point gateway?

Re: Remote Access VPN on Gateways behind another firewall

the_rock — Fri, 02 Jun 2023 01:57:00 GMT

Sounds like you have the right config already. As phoneboy said, maybe do some packet captures to see what gives. Some examples below (lets just assume client IP is 1.2.3.4 and gw ip is 4.3.2.1)

On gateway (expert mode)

fw ctl zdebug + drop | grep 1.2.3.4

fw monitor -e "accept host(1.2.3.4) and host(4.3.2.1);"

fw monitor -e "accept port(18234);" (18234 is tunnel test port)

fw monitor -F "1.2.3.4,0,4,3,2,1,0,0" -F "4.3.2.1,0,1.2.3.4,0,0"

Idea in last command is this "srcIP,srcPort,dstIP,dstport,protocol" and then 2nd one is just other way around

Let us know what you get.

Hope those help.

Im fairly experienced in Foirtinet (though nothing like few of my colleagues lol), but you can also do packet capture there as well. I know in any 7.x.x version, its available via GUI, or just via cli:

diag sniffer packet any host x.x.x.x 4 50

This is in latest 7.4.0 version

Andy

Re: Remote Access VPN on Gateways behind another firewall

OmarDafiri — Thu, 15 Jun 2023 09:48:37 GMT

Hello everyone,

Thank you so much for your suggestions and your feedback, and am sorry for my late response.

We managed to fix the issue. Indeed, the Fortigate guy didn't perform a Dnat to check point VIP, that's why it didn't work.

Once he perfomed it, the client VPN worked perfectly.

Thank you again for your assistance and your help.

Regards,

DAFIRI Omar

Re: Remote Access VPN on Gateways behind another firewall

the_rock — Thu, 15 Jun 2023 10:12:43 GMT

Excellent! 👍