topic Re: VPN Domain and VPN VTI in Spark Firewall (SMB)

VPN Domain and VPN VTI

Marquevis — Tue, 31 Dec 2024 11:29:11 GMT

Hello,

I have a customer with several locally managed SMB gateways. Each SMB gateway has at least 03 VPN DOMAIN. The need arose to configure some VTI VPN. In the documentation, VTI VPN requires that the tunnel is per gateway pair. In the SMB gateway settings I only find this setting globally. I cannot change this configuration globally, because VPN DOMAIN will be unavailable. I need to find a way to configure VPN DOMAIN and VPN VTI on the SMB gateway, without changing this configuration globally.

Re: VPN Domain and VPN VTI

the_rock — Tue, 31 Dec 2024 13:08:21 GMT

Let me spin up quick smb spark demo and see.

Andy

Re: VPN Domain and VPN VTI

the_rock — Tue, 31 Dec 2024 13:18:20 GMT

Hey, not sure what was the setting you were referring to, but is it possible its below?

Andy

Re: VPN Domain and VPN VTI

Marquevis — Tue, 31 Dec 2024 13:35:41 GMT

Hello the_rock.

The configuration I'm referring to is the one below.

One of the requirements for configuring VTI is that we use gateway pair configuration.

Re: VPN Domain and VPN VTI

the_rock — Tue, 31 Dec 2024 13:40:17 GMT

My apologies, I cant seem to find that in demo I spun up, but will check again. So you are saying thats global option?

Andy

Re: VPN Domain and VPN VTI

Marquevis — Tue, 31 Dec 2024 13:43:00 GMT

Yes, it is a global configuration.

I need to find a way to do this configuration on each VPN site. Some VPNs will have a subnet pair and others will have a gateway pair.

Re: VPN Domain and VPN VTI

the_rock — Tue, 31 Dec 2024 13:49:01 GMT

So sorry I dont have access to real smb device to test : - (. Is there any setting on specific vpn tunnel that would let you change it or this is the only place?

Andy

Re: VPN Domain and VPN VTI

Marquevis — Tue, 31 Dec 2024 13:52:18 GMT

This is exactly what I'm looking for. It seems to me that there is only this global configuration.

Re: VPN Domain and VPN VTI

the_rock — Tue, 31 Dec 2024 13:58:20 GMT

Got it. Are you allowed to do remote? I really want to try and help with this, because I have a gut feeling might be possible.

Andy

Re: VPN Domain and VPN VTI

Marquevis — Tue, 31 Dec 2024 14:01:10 GMT

Unfortunately, our internal policy does not allow this.

Re: VPN Domain and VPN VTI

the_rock — Tue, 31 Dec 2024 14:34:28 GMT

Understood. So, if you edit any given vpn tunnel, you dont see option to change this individually at all?

Andy

Re: VPN Domain and VPN VTI

Marquevis — Tue, 31 Dec 2024 14:40:17 GMT

Correct, I don't see any option to change this individually.

If this option exists, it must be within some configuration file in the shell.

Re: VPN Domain and VPN VTI

the_rock — Tue, 31 Dec 2024 14:44:03 GMT

Maybe SMB master @G_W_Albrecht might know? Otherwise, I would recommend asking TAC via official case. I will keep checking in the meantime, just bit tricky with demo, as I cant seem to get RDP to open in full screen.

Andy

Re: VPN Domain and VPN VTI

the_rock — Tue, 31 Dec 2024 14:54:21 GMT

I just created bogus tunnel and sadly, cant see option anywhere in the settings similar to below in smart console community.

Andy

Re: VPN Domain and VPN VTI

Marquevis — Mon, 06 Jan 2025 11:52:40 GMT

The checkpoint instructed me to configure the unnumbered VTI.

https://support.checkpoint.com/results/sk/sk121740

Re: VPN Domain and VPN VTI

the_rock — Mon, 06 Jan 2025 12:18:06 GMT

Thats fine, but not sure if that really addresses your issue specifically?

Andy

Re: VPN Domain and VPN VTI

the_rock — Mon, 06 Jan 2025 12:29:57 GMT

Though, now that I read that sk again @Marquevis , appears it should help, since its related to individual vpn tunnel.

Andy