topic Re: Chekcpoint appliance 1490 VPN site to site Problem in Spark Firewall (SMB)

Chekcpoint appliance 1490 VPN site to site Problem

dwinurm — Thu, 14 Mar 2019 06:05:53 GMT

Hi all,

anyone can help me, i create tunnel site to site between checkpoint and fortigate

the tunnel is up, but i can't ping from local address to remote address

from remote address to local address can ping

i'm already configure the policy rule and NAT rule.
can anyone help my problem

thank you

Re: Chekcpoint appliance 1490 VPN site to site Problem

HristoGrigorov — Fri, 15 Mar 2019 06:07:14 GMT

You need to include remote network(s) in VPN domain.

Re: Chekcpoint appliance 1490 VPN site to site Problem

dwinurm — Sun, 17 Mar 2019 19:41:55 GMT

i'm already include the remote network(s)

Re: Chekcpoint appliance 1490 VPN site to site Problem

HristoGrigorov — Mon, 18 Mar 2019 04:16:24 GMT

Is the packet encrypted or not ? You should be able to see that in the log. If it is encrypted then the problem is likely on the Fortigate's side.

Re: Chekcpoint appliance 1490 VPN site to site Problem

dwinurm — Mon, 18 Mar 2019 08:00:07 GMT

the packet no encrypted on log, the packet through firewall blade, not on the vpn blade.

Re: Chekcpoint appliance 1490 VPN site to site Problem

HristoGrigorov — Mon, 18 Mar 2019 18:24:04 GMT

You must have a dedicated access rule and specify that traffic that is matching it shall be encrypted. This is achieved differently according to how is appliance managed - centrally or locally. Check the appropriate guide for that.

Re: Chekcpoint appliance 1490 VPN site to site Problem

dwinurm — Tue, 19 Mar 2019 06:22:07 GMT

my checkpoint 1490 appliance locally managed,

and i have configured access policies and NAT policies like this :

Access Policy rule :

NAT Policy Rule :

any issue with this configuration?

Re: Chekcpoint appliance 1490 VPN site to site Problem

HristoGrigorov — Wed, 20 Mar 2019 15:38:47 GMT

In service column you shall specify services you want to pass through VPN (e.g. ICMP, HTTP, etc). Currently you specify that only IPSec protocol is to be encrypted in the community. And that is not even needed.

Re: Chekcpoint appliance 1490 VPN site to site Problem

dwinurm — Thu, 21 Mar 2019 03:22:51 GMT

i'm change service with any service, but the result are the same

Re: Chekcpoint appliance 1490 VPN site to site Problem

HristoGrigorov — Fri, 22 Mar 2019 04:30:21 GMT

As you are using NAT is it allowed for VPN connection as well? Both sides needs to do that.

Re: Chekcpoint appliance 1490 VPN site to site Problem

dwinurm — Mon, 25 Mar 2019 09:55:03 GMT

what happens when i'm clear the NAT rule?