Showing results for 
Search instead for 
Did you mean: 
Create a Post

VPN over VPN


How can I do vpn tunnel inside another vpn tunnel (check point)?

Tags (1)
0 Kudos
3 Replies

Re: VPN over VPN

Between which peers do you want the VPN ? The CP VPN is created between two GWs and - apart from FW rules - transparent, so a client/server behind one GW can connect using VPN to a client/server behind the other GW.

0 Kudos

Re: VPN over VPN

A third-party VPN-client (not CP) is installed on the employee's PC. Also, a third-party VPN-client is installed on an employee’s PC at another office. It is necessary that third-party VPN traffic passes inside the CP VPN tunnel, created between two CP GWs (VPN inside VPN)

0 Kudos

Re: VPN over VPN

Scheme like this:

(user, want to OpenVPN server)-----"openVPN secured traffic"---->(CP GW)------"openVPN secured trafic encapsulated to IPSec"--------------------->(CP GW)------"decapsulated from IPSec openVPN secured traffic"----->(OpenVPN server)

If you control transport, for some reasons you may incapsulate "openVPN secured trafic encapsulated to IPSec" into GRE tunnel between transport routers (such as cisco). So you can have vpn-in-vpn-in-vpn. OpenVPN traffic inside CheckPoint's VPN and CheckPoint's VPN inside GRE tunnel. Also you may create IPSec vpn between CP and 3rd party hardware. You should show your "path" of traffic for better understanding situation.

For this minimal scheme, you must add user and server in vpn encryption domain on CP sides, add both CP into same VPN community. CP will create VPN between they and encrypt "openVPN traffic" between user and server

0 Kudos