topic Re: Checkpoint R600 appliance L2TP pass through in Spark Firewall (SMB)

Checkpoint R600 appliance L2TP pass through

Carl_Stainton — Tue, 20 Jun 2017 15:25:25 GMT

I am using a Checkpoint R600 appliance and wish to override the built in handling of l2tp traffic and forward to an internal vpn server. Has anyone done this ? I've set up forwarding rules but they are overridden by the internal services for IKE and IKE traversal.

Thanks for any advice, Carl

Re: Checkpoint R600 appliance L2TP pass through

PhoneBoy — Tue, 20 Jun 2017 21:38:52 GMT

Actually, the 600 has an L2TP endpoint on it your clients can connect to--see sk101466.

Make sure the relevant options are disabled.

Re: Checkpoint R600 appliance L2TP pass through

Carl_Stainton — Tue, 20 Jun 2017 21:44:25 GMT

Thanks Dameon, but we want to do pass through as the Active Directory authentication doesn’t work with our OpenLDAP (though it does work on the internal destination).

Re: Checkpoint R600 appliance L2TP pass through

PhoneBoy — Tue, 20 Jun 2017 21:55:31 GMT

Understood.

What I'm saying is if these options are enabled, it definitely won't work

How are you attempting to configure L2TP passthrough?

Can you post screenshots of the rules you're attempting to use?

Re: Checkpoint R600 appliance L2TP pass through

Carl_Stainton — Tue, 20 Jun 2017 22:01:16 GMT

I can't screenshot at the moment as not in work. The remote access vpn is disabled at the admin interface, and just to be doubly sure, I've ran "vpn drv off" from clish.

The passthrough is attempted via an access policy forwarding udp ports 500,1701 and 4500 on to the internal destination.

Re: Checkpoint R600 appliance L2TP pass through

PhoneBoy — Tue, 20 Jun 2017 22:05:53 GMT

Understood.

I will have to check with someone in R&D to see if this is possible or not.

Re: Checkpoint R600 appliance L2TP pass through

Carl_Stainton — Tue, 20 Jun 2017 22:07:25 GMT

I should also add the logs show that when attempting a connection in this scenario, I get entries referencing the VPN and also IKE and IKE traversal rather than any forwarding going on.

Re: Checkpoint R600 appliance L2TP pass through

Carl_Stainton — Tue, 20 Jun 2017 22:12:44 GMT

Thanks - if the passthrough is not possible, I would be also be content to use the UTM VPN endpoint if we could link to the users and groups we've already defined under our ldap server, though sadly it seems just Active Directory is supported.

Re: Checkpoint R600 appliance L2TP pass through

PhoneBoy — Wed, 21 Jun 2017 13:25:35 GMT

To disable the implied rules around L2TP, a code change may be required.

Please open a support ticket, who will be able to investigate with R&D.

Also possible support may be able to assist in getting the 600 to talk to a generic LDAP server instead of Active Directory.

Re: Checkpoint R600 appliance L2TP pass through

Carl_Stainton — Thu, 22 Jun 2017 10:21:40 GMT

Thanks Dameon, I appear to have to get support through the reseller which is particularly onerous. I tinkered with the possibility of using the routers own endpoint and maintaining a temporary user database for those in need, but even the default office mode routing seems screwy. I suppose some additional configuration is required there. Naively I thought routing everything in the office mode default 172.16.10.0.x via the gateway at 172.16.0.1 would work but no DNS was supplied to my test client and even reaching LAN resources by ip was not possible.

Re: Checkpoint R600 appliance L2TP pass through

Carl_Stainton — Thu, 22 Jun 2017 11:55:52 GMT

Hi Dameon,

Further bit of info, some of the IPSEC IKE stuff is making it to the internal endpoint, it is the L2TP connection that fails. Reading up on some similar cases with other equipment they have to add a nat-network entry of the form 0.0.0.0/0

Now I just need to know where to add this in expert mode I think.

Re: Checkpoint R600 appliance L2TP pass through

PhoneBoy — Thu, 22 Jun 2017 17:34:48 GMT

You don't create NAT rules in Expert mode, but you can create them through the CLI.

It wouldn't operate any differently than doing it through the WebUI.

In any case, "any" is equivalent to 0.0.0.0/0, or you might have to create a range object to cover 0.0.0.1-255.255.255.255.