topic Re: Force NAT-T for S2S VPN with two DAIP locally managed appliances in Spark Firewall (SMB)

Force NAT-T for S2S VPN with two DAIP locally managed appliances

Stephan_Kremer — Tue, 01 Oct 2019 06:28:55 GMT

Hi all,

I have two locally managed DAIP gateways (620 & 730). I need to create a site-to-site VPN between them:

620 -----> NAT device ------> Internet ------> NAT device -----> 730

730 is configured that only remote site opens the connection. 620 is using the hostname to open the connection. Authentication is based on certificates and IKEv1 is used. Using the hostname to connect, NAT-T is not used and so the tunnel is not established. If I temporary change the connection from hostname to IP between static NAT, then the tunnel comes up because NAT-T is used.

My question: how can I force the gateway to use NAT-T when connecting to a hostname instead of an IP?

Many thanks,

Stephan

Re: Force NAT-T for S2S VPN with two DAIP locally managed appliances

G_W_Albrecht — Tue, 01 Oct 2019 06:58:57 GMT

This is explained in sk162472: How to force NAT-T on Gaia Embedded devices

Re: Force NAT-T for S2S VPN with two DAIP locally managed appliances

Stephan_Kremer — Tue, 01 Oct 2019 07:32:14 GMT

I will give it a try later on, sounds promising. Thanks!

Re: Force NAT-T for S2S VPN with two DAIP locally managed appliances

Stephan_Kremer — Tue, 01 Oct 2019 15:08:42 GMT

I gave it a try, but there is a known limitation that seems to match exactly my environment:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk105380

ID: 01620625

Does anybody know if there is a workaround or fix available, so would it make sense to open a SR?

Re: Force NAT-T for S2S VPN with two DAIP locally managed appliances

PhoneBoy — Sat, 05 Oct 2019 05:13:09 GMT

This would most likely require an RFE to address.

Re: Force NAT-T for S2S VPN with two DAIP locally managed appliances

Stephan_Kremer — Sun, 06 Oct 2019 06:42:12 GMT

Yes, I opened a RFE. Let‘s see what happens. Thanks.

Re: Force NAT-T for S2S VPN with two DAIP locally managed appliances

G_W_Albrecht — Wed, 09 Oct 2019 13:12:47 GMT

I think that sk105380 and sk162472 contradict each h other - did you try sk162472 yet ?

Re: Force NAT-T for S2S VPN with two DAIP locally managed appliances

Stephan_Kremer — Wed, 09 Oct 2019 13:30:06 GMT

Yes, sure I tried but it does not work. The contradiction is quite obvious 🙂

Re: Force NAT-T for S2S VPN with two DAIP locally managed appliances

G_W_Albrecht — Wed, 09 Oct 2019 13:32:58 GMT

RFE is nice, but did you already consult TAC ?

Re: Force NAT-T for S2S VPN with two DAIP locally managed appliances

Stephan_Kremer — Wed, 09 Oct 2019 13:40:37 GMT

Yes, they confirmed that the limitations is still valid and I need to open a RFE.