Cannot ping remote VPN gateway external IP

[dilirium]

This question has already been asked, and I carefully read the answers to it.

https://community.checkpoint.com/t5/General-Topics/Cannot-ping-remote-VPN-gateway/td-p/20797.

Setting "Accept ICMP requests" -> "First" in the Global Properties causes ping to the external interface to work, but it is not possible to ping the hosts behind the gateway. If you put "Before Last", then we get the opposite picture.

In another answer it was written that I need to prescribe rules for ping. Can you give an example of these rules? I tried several variants of the rules, but did not achieve a positive result.

Is it generally possible to ping the external interface of the gateway and the hosts behind it?

[G_W_Albrecht]

Between two sites connected with VPN, you can ping internal hosts of one site from internal hosts of the other side if "disable NAT inside the VPN community" is enabled and a rule allows that traffic.

[HeikoAnkenbrand · Accepted solution]

The external IP of the firewall is included in the VPN topology. So you can't ping her.

More read here:

Customizing VPN Domain to exclude IP Address and allow clear text

I think there is also another SK to exclude the external IP from the VPN tunnel. Unfortunately I can't find the SK anymore.

[Leonard_Schwoch]

This is a very interesting SK.