Question on IPSEC VPN

[SriNarasimha005]

Hi Experts,

I've been asked to provision the new IPSEC VPN tunnel between Checkpoint and the 3rd party device. I've got quick question and I'd like to seek your help.

Below is the traffic flow:-

3rd party (Source/Encryption domain: 10.40.1.0/24) -> Internet-facing Checkpoint FW (Hide NAT: 10.50.1.1/32) -> Internal Firewall -> Server (Destination: 10.60.1.1/32)

1. The checkpoint firewall haven't been configured with Main address/topology IP with the Public IP address. Hence I decided to use 'Statically NAT IP' under link selection with the public IP- 1.2.3.4 and configure the upstream Internet router with the Static NAT of 1.2.3.4 -> Eth1 (Internet-facing Interface) Cluster VIP. Will it work?

2. Should I need to explicitly allow the firewall rules between 1.2.3.4 -> 5.6.7.8 with IKE and ESP for the VPN to come up or will it be allowed via implied rules automatically?

3. The Destination is being Hide NAT'd with the source: 10.50.1.1/32 on the Checkpoint firewall. I believe this should be part of the encryption domain and not the original server-10.60.1.1/32?

4. Should I need to add a route on the Internet-facing Checkpoint firewall for the 3rd party subnet:10.40.1.0/24 towards Interface of the default-route for the return traffic or will it be routed via VPN tunnel automatically since it's part of the encryption domain?

Thank you.

[PhoneBoy · Accepted solution]

1. Yes, this is correct.

2. Should be handled with implied rules automatically, yes.

3. The encryption domain on the local system should contain the addresses pre-NAT that will communicate over the VPN. The remote will need to account for the relevant NAT IP in their definition for your site.

4. Default route should cover it in this case. The only time you need an explicit route is if you want to use a different interface for outbound VPN traffic. 

[SriNarasimha005]

Hi @PhoneBoy @the_rock Gents,

Many thanks for your feedback.

With regards to Point#3, you've highlighted as the Pre-NAT addresses which implies about the real-server IP (10.60.1.1/32). As per my understanding, I believe, Encryption happens after the source NAT. In this case, on the local system/Checkpoint shouldn't we be configuring the NAT'd IP addresses on the encryption domain?

With regards to Point#4, Apologies, I missed to highlight it. Internet facing firewall is having a wider-route towards the Internal/Core firewall for 10.0.0.0/8. In this scenario, should we need to place the route for the source: 10.40.1.0/24 on the Internet facing firewall towards the default-route from preventing the traffic being routed back to the Internal firewall again? Or will it be automatically sent via the tunnel without any specific route?

Please help to clarify 😊

[PhoneBoy]

NAT happens when the packet is routed on the local gateway (before the Output chains).
The NAT IP does not need to be in your local Encryption Domain.

With the details you provided, yes, an explicit route on the gateway for 10.40.1.0/24 is necessary. 

[the_rock]

Here is what I would do, just to be 100% sure. if natting is needed for vpn, MAKE SURE that both original and natted IP(s) are part of VPN domain.

Andy

[the_rock]

You got the answers from phoneboy and they are correct.

Andy