First of all, I thank you for your response! It is much appreciated.
Before attempting to configure it via the use of two separate star community objects, I have gone through the notes of the following URLs about VPN Routing: 1. https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_SitetoSiteVPN_AdminGuide/htm....
2. https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_RemoteAccessVPN_AdminGuide/Topics-...
3. https://community.checkpoint.com/t5/Remote-Access-VPN/VPN-Routing-Action/td-p/97007.
4. https://sc1.checkpoint.com/documents/R80.20/SmartConsole_OLH/EN/html_frameset.htm?topic=documents/R8....
5. https://sc1.checkpoint.com/documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_RemoteAccessVPN_AdminGuid....
6. https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SitetoSiteVPN_AdminGuide/Topics-VP....
7. https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SitetoSiteVPN_AdminGuide/CP_R81_Si...
According to these Notes, I used only one star community object. In this community object, the central gateway [The HUB] is a checkpoint Security Gateway [Maestro Security Group instance], whereas the satellite Gateways are non-checkpoint products/VPN Gateways, and I have no information about which vendor's product they are. This is a Site-to-Site VPN tunnel to be established between two of our partner companies, where traffic from the host of one company must pass through our gateway to the host of the second partner.
Nevertheless, the traffic from SPOKE A host was not able to reach the host behind SPOKE B, even if it were received by the HUB and vpn-route attempted by the checkpoint Gateway HUB, as indicated in the previously shared log data.
After some search through Gen AI, I decided to use a two-star community object, with the same encryption parameters, between each spoke and the hub. With this config, both phases of the tunnel have turned up; traffic from hosts behind Spoke A can reach the HUB and get VPN routed to SPOKE B; Still, this traffic is not being seen by the SPOKE B VPN Gateway.
The Gen AI strictly informs that the VPN Routing scenario, where different vendors' SPOKE VPN gateway and checkpoint HUB gateway are to be used, should be configured that way.
Even if I configured the IPSec tunnel, both ways, I get the same result. No traffic from the host residing behind either of the spokes is reaching the other. Furthermore, there is no issue with traffic from encryption domains residing behind the HUB to the VPN domains behind either of the SPOKEs. I can access a service residing on an encryption domain of SPOKE B from the VPN domain that belongs to the HUB [Checkpoint IPSec VPN Gateway].
