topic Re: VPN S2S CP 700 Series WAN Behind NAT in Spark Firewall (SMB)

VPN S2S CP 700 Series WAN Behind NAT

luk89as — Fri, 11 Mar 2022 07:20:55 GMT

Hello,

I have two Chececkpoint 750 and 730 gates.

Checkpoint 750 has an assigned public IP address on the WAN port.

Checkpint 730 is assigned a local IP address on the WAN port.

The address on the Checkpoint 730's WAN port is NAT 1: 1 from a public IP address.

This configuration results from the change of the link provider.

In the old configuration where both Checkpoints had public addresses on WAN ports, the S2S VPN connection worked without any problems.

After changing link provider and NAT public address to local WAN 1: 1 address, Checkpoint 730 presents itself to local WAN address. For this reason, the S2S VPN does not work.

In the S2S Checkpoint 750 VPN configuration, I configured the remote site behind NAT and provided the local address it was behind.

Still, it doesn't work.

Am I making a configuration error or is the supplier blocking something? Normal Gate <--> client connection works fine.

Re: VPN S2S CP 700 Series WAN Behind NAT

G_W_Albrecht — Fri, 11 Mar 2022 08:11:19 GMT

Can we move this post to Spark/SMB, @_Val_ ?

Re: VPN S2S CP 700 Series WAN Behind NAT

luk89as — Fri, 11 Mar 2022 08:49:45 GMT

OK. Please move this post to Spark/SMB

Re: VPN S2S CP 700 Series WAN Behind NAT

_Val_ — Fri, 11 Mar 2022 08:57:28 GMT

@G_W_Albrecht done. Also, you now are able to move the posts yourself 🙂 Please use this with caution.

Re: VPN S2S CP 700 Series WAN Behind NAT

G_W_Albrecht — Fri, 11 Mar 2022 09:12:37 GMT

I promise that i will 8)

Re: VPN S2S CP 700 Series WAN Behind NAT

luk89as — Tue, 15 Mar 2022 12:14:20 GMT

Hello,

Is it possible to configure what ip address Checkpoint 730 should present itself when connecting VPN S2S? It's about the WAN address.

Currently, the WAN port of Checkpoint 730 has a local 1: 1 nat address from a public IP.

All ports and services are not blocked by the provider. The problem is only the local IP address on the WAN nat 1: 1 port from the public address.

Re: VPN S2S CP 700 Series WAN Behind NAT

G_W_Albrecht — Tue, 15 Mar 2022 12:29:13 GMT

Can be configured in Advanced Settings:

If that is not what you try to achieve, look at the other VPN S2S settings

Re: VPN S2S CP 700 Series WAN Behind NAT

luk89as — Thu, 20 Oct 2022 06:24:11 GMT

I started S2S VPN connection.

In the S2S VPN settings I checked the option: "Disable NAT for this site"

I applied the setting to both Checkpoint devices.

Re: VPN S2S CP 700 Series WAN Behind NAT

Tom_Hinoue — Mon, 24 Oct 2022 06:13:35 GMT

Does the new ISP link use CG-NAT where public IP is shared with other subscribers?
If so, using aggressive mode from CP730 to CP750 might be a choice. (CP730 as initiator, CP750 as responder)