topic Re: VPN tunnel does not ping the address in SASE and Remote Access

VPN tunnel does not ping the address

Dmitryfd — Fri, 25 Nov 2022 08:37:26 GMT

Good afternoon friends.

Tell me please, I have checkpoint 1590 under local control. I set up a vpn tunnel with the address, the tunnel is active, but after that this address is not pinged and the tracert command does not work.
What else do I need to do to get access to the desired address.
Grateful for any help

Re: VPN tunnel does not ping the address

PhoneBoy — Fri, 25 Nov 2022 20:29:49 GMT

What is your precise configuration?
Please provide descriptions (with screenshots) and a basic network diagram.

Re: VPN tunnel does not ping the address

the_rock — Sat, 26 Nov 2022 02:37:06 GMT

We definitely need some more info...please provide IP in question, basic routing, config, maybe as @PhoneBoy asked, also network diagram would help (even something in MS paint).

Andy

Re: VPN tunnel does not ping the address

Dmitryfd — Mon, 28 Nov 2022 04:47:07 GMT

My external address is (for example) 194.1.1.1, the tunnel is set from 86.1.1.1, the internal address of the desired network is 172.17.0.0 in the tunnel settings, on the other hand my network is 192.168.1.0. There is no ping. I turn off the tunnel - there is a ping on 86.1.1.1. I allow the addresses 86.1.1.1 and 172.0.0.0 in the policies - there is no ping.

Re: VPN tunnel does not ping the address

PhoneBoy — Mon, 28 Nov 2022 14:22:47 GMT

What shows up in the logs when you attempt to do this ping?
Have you done any troubleshooting with tcpdump and similar to see if traffic is actually being encrypted and sent to the remote end?

Precise configuration steps taken (with screenshots) would go a long way towards helping you solve the issue.

Re: VPN tunnel does not ping the address

Dmitryfd — Tue, 29 Nov 2022 04:36:24 GMT

when I ping 172.17.0.172 - the log is empty.
if you can write the exact tunnel setup to get from the network 192.168.1.0 to 172.17.0.0?

Re: VPN tunnel does not ping the address

PhoneBoy — Tue, 29 Nov 2022 14:17:51 GMT

https://sc1.checkpoint.com/documents/SMB_R80.20.60/AdminGuides/Locally_Managed/EN/Topics/Configuring-VPN.htm?tocpath=_____8

Re: VPN tunnel does not ping the address

Dmitryfd — Wed, 30 Nov 2022 05:05:58 GMT

I did everything in your link, but it still doesn't work.
I have in the device-routing section - when creating a new route, the next hop vti (tunnel) is not active.

this is normal?

Re: VPN tunnel does not ping the address

PhoneBoy — Wed, 30 Nov 2022 18:35:49 GMT

What is the remote end of the VPN in this case?
What precisely (with screenshots) have you configured on your end?
If you don't want to share this publicly, I recommend working with our TAC.
Also, for debugging, see: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk34467&partition=Advanced&product=IPSec

Re: VPN tunnel does not ping the address

Dmitryfd — Thu, 01 Dec 2022 04:46:34 GMT

on my side, a tunnel is configured to address 194.1.1.1. its internal network is 172.17.0.0. On its side is my address 86.1.1.1. and my internal network is 192.168.0.0. In the tunnel settings, ipsec is specified - the tunnel is active.
But, there is no ping to the address 194.1.1.1, I turn off the tunnel - there is a ping.
In politicians allowed everything to the address 194.1.1.1. and 172.17.0.0.
What else needs to be done?

Re: VPN tunnel does not ping the address

Blason_R — Thu, 01 Dec 2022 07:07:31 GMT

I am sorry I have not looked up the entire configuration but are you trying to ping peer IP from your firewall which is establishing a VPN tunnel? And if so then you wont be able to as a design. You can probably excldue echo-request from the VPN community and try?

Re: VPN tunnel does not ping the address

Dmitryfd — Thu, 01 Dec 2022 07:57:36 GMT

my configuration

Re: VPN tunnel does not ping the address

Blason_R — Thu, 01 Dec 2022 11:13:16 GMT

Yes - It wont be able to ping peer IP address for VPN.

Re: VPN tunnel does not ping the address

Dmitryfd — Thu, 01 Dec 2022 11:53:30 GMT

why, please tell me the solution?

Re: VPN tunnel does not ping the address

the_rock — Thu, 01 Dec 2022 12:46:03 GMT

Just curious, what happens if you trace route to that IP? Does it even take any hops? If you say it works without VPN, can you send us the path you get?

Re: VPN tunnel does not ping the address

Blason_R — Thu, 01 Dec 2022 12:51:41 GMT

Yes that is right!! It never goes out. It drops the connection

Re: VPN tunnel does not ping the address

Blason_R — Thu, 01 Dec 2022 12:52:59 GMT

As I said you can create a custom tunnel with crypt.def and exclude the peer IP since this is known and documented solution or exclude echo-request from tunnel but this way no one will be able to ping through tunnel.

Re: VPN tunnel does not ping the address

Dmitryfd — Thu, 01 Dec 2022 13:07:08 GMT

I ask you to be condescending, I'm just starting to master checkpoint1590,

tell me what exactly I need to do to set it up, step by step?

Re: VPN tunnel does not ping the address

the_rock — Thu, 01 Dec 2022 13:12:00 GMT

Hey @Dmitryfd ,

No one is condescending, we are simply doing our best to help you. @Blason_R actually gave good suggestion. I believe he was referring to below article:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk25675

But, can you please answer what I asked before if you dont mind? It would be good if we could see trace route to that external IP through the tunnel and when it works.

Andy

Re: VPN tunnel does not ping the address

Blason_R — Thu, 01 Dec 2022 13:48:47 GMT

@the_rockhas given the correct link and @Dmitryfd as I said unfortunately its not possible without those efforts. I am not sure how do you exclude the IP address from community the way we do it on mgmt server. I use to do the same way. exclude the echo-request from vpn community and then PING if that succeed then add it in community again.

Or here is one more trick. NAT the traffic going to PEER IP Address behind other IP and you should be able to ping to Peer IP like this

Lets suppose your encryption domain is 10.1.1.0/24

FW IP is 1.1.1.1

Peer IP is 2.2.2.2

Then nat one of the IP fro 10.1.1.0 like 10.1.1.100 behind 1.1.1.2 - Since now 1.1.1.2 and 2.2.2.2 is not a part of vpn tunnel you should be able to ping from encryption domain.