Numbered VTIs with 3rd party

[fab]

Hi guys.

I'd like to create a route based VPN to a 3rd party site. As our Internet facing interface is configured as a bond I need to use numbered VTIs instead of unnumbered.

At the moment it is unclear to me what the local and remote IPs are used for and if the 3rd party needs knowledge about those IPs, i.e. if the remote IP of the numbered VTI e.g. is 192.0.2.1/24 do they need to know and and / or do they need to configure the IP on their site somewhere?

Hope this makes any sense,

Frank.

[Hugo_vd_Kooij]

Sure they do. They have to match the numbered link you defined or there will be no traffic passing through your tunnel.

[Gaurav_Pandya · Accepted solution]

Hi,

You can give any IP addresses for VTIs but it should be defined at both ends. For more clarification, please check below thread.

 https://community.checkpoint.com/t5/General-Topics/Route-Based-VPN/m-p/34463

[fab]

Thanks. While my post was awaiting moderation I went to the lab and created a route based VPN between a FreeBSD box and Check Point R80.x and I was able to observe the same behaviour: basically for my needs the local and remote IPs don't matter and both parties had no knowledge of the other's configuration wrt the IPs used inside the tunnel.

Routing on Check Point was done via `nexthop gateway logical' and on the FreeBSD Site I just routed traffic via it's own IP inside the tunnel. Worked flawless. I guess I missed your thread because your stated problem was "Traffic is not being encrypted' so I expected a different problem.

Thanks,

Frank.