Enable Internet Access to LAN RRAS IPSec/LT2P VPN Server Behind 1530 Appliance

msl58 — Sat, 07 Sep 2024 13:14:40 GMT

My IPS just provided me with a 1530 Appliance running R80.20.15, in place of another vendor's appliance which had failed.

In my LAN I am running RRAS on a Microsoft Server 2019 to provide IPSec/LT2P access to my LAN from the Internet. This server is NAT-ed behind the appliance firewall.

My ISP does not know how to enable this. I know nothing about Checkpoint appliances either,

I think what I need to do is:

Define new Service ESP (IP Protocol 50)
Define new Service AH (IP Protocol 51)
Allow UDP Ports 500, 4500, and 1701
Forward all of the above IP protocols and UDP ports to the RRAS server in the LAN according to its NAT-ed address.

Am I correct? Is there an error in what I wrote? Did I forget something?

If my list of tasks is correct, I would be grateful for painfully explicit instructions as to how to accomplish the above.

TIA!

Re: Enable Internet Access to LAN RRAS IPSec/LT2P VPN Server Behind 1530 Appliance

PhoneBoy — Mon, 09 Sep 2024 16:16:47 GMT

The device does have Remote Access functionality built into it, FYI.
Make sure both Remote Access and Site to Site VPN are disabled in Home > Overview > Security Dashboard

I don't believe you need to forward IP Proto 50/51, but could be wrong.
However, you should create a Server object in Users and Objects > Network Resources > Servers and specify the correct ports:

Set the other options as appropriate in the object.

topic Enable Internet Access to LAN RRAS IPSec/LT2P VPN Server Behind 1530 Appliance in Spark Firewall (SMB)

Enable Internet Access to LAN RRAS IPSec/LT2P VPN Server Behind 1530 Appliance

Re: Enable Internet Access to LAN RRAS IPSec/LT2P VPN Server Behind 1530 Appliance