topic Re: Multiple IPsec Tunnel Configuration - Checkpoint SMB in Spark Firewall (SMB)

Multiple IPsec Tunnel Configuration - Checkpoint SMB

khineminn — Mon, 20 May 2024 09:43:46 GMT

Hello Dears,

I would like to create two tunnels with peer sides and allow separate local encryption domain IPs for each tunnel as follows (I don't want to use the full subnet).

Tunnel 1 - Local ED 192.168.1.100 Remote ED 10.10.10.0/24
!
Tunnel 2 - Local ED 192.168.1.200 Remote ED 10.20.30.0/24

I think the configuration for Remote ED is okay and it's with dedicated VPN sites. However, for Local ED, I have no idea how to configure it and how to separate it for each tunnel.

Re: Multiple IPsec Tunnel Configuration - Checkpoint SMB

CaseyB — Mon, 20 May 2024 13:10:59 GMT

As long as you are on R80.40+, you can use granular encryption domains to accomplish this task.

Local FW - Build a network group with the two local ED IP's defined as /32 subnets.
Remote FW - Build a network group with the two remote subnets.
Build a mesh / start VPN community and use the above created network groups as the granular encryption domains and leave it as subnet to subnet IKE exchange.
Create FW rules as needed.

Re: Multiple IPsec Tunnel Configuration - Checkpoint SMB

khineminn — Tue, 21 May 2024 04:02:22 GMT

We are using Checkpoint Spark SMB 1800 with R81.10.10 and local management. Is there any configuration example to setup like multiple tunnels.

Re: Multiple IPsec Tunnel Configuration - Checkpoint SMB

CaseyB — Tue, 21 May 2024 13:30:34 GMT

I am not familiar with local management configuration of the SMB devices. If I had a spare SMB gateway, I could probably mock something up real quick, but none of my current SMB devices run R81.10.

Re: Multiple IPsec Tunnel Configuration - Checkpoint SMB

PhoneBoy — Tue, 21 May 2024 14:57:56 GMT

If this is locally managed, you're probably going to have to hack .def files to achieve the desired result, for example Option 1 in: https://support.checkpoint.com/results/sk/sk108600