Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Gaurav_Pandya
Advisor

Route Based VPN

Hi,

I am trying to establish route based VPN and I have created numbered VTIs on both firewalls with help of SK113735. But traffic is going in clear text, it is not encrypting traffic. 

Please let me know if any other setting, creating community etc. needs to be done.

0 Kudos
14 Replies
Vladimir
Champion
Champion

Gaurav,

Please review the second portion of this How to configure IPsec VPN tunnel between Check Point Security Gateway and Amazon Web Services VPC u... 

to see the creation of the VPN community for route-based VPNs. It should be more broadly applicable than just AWS.

Cheers,

Vladimir

Gaurav_Pandya
Advisor

Thanks Vladimir for the response.

I will try it to configure.

0 Kudos
Gaurav_Pandya
Advisor

Hi,

I have configured route based VPN but tunnel is not coming UP. fails at phase1. Just want to confirm that I have configured VTIs in correct manner.

Environment : Single GW (Not in cluster)

VTI : Local address - Public IP of My GW (External IP)

        Remote address - Public IP of Remote GW (External IP)

Static Route : Next hope is Public IP of Remote GW.

0 Kudos
Maarten_Sjouw
Champion
Champion

As I said in my post have a look at the first image, in the top left you enter the 169.254 addresses you get for local and remote, the look at the first lines of the CLISH code which configures the VTI's it shows you the 169.254 addresses, not the real IP's of the hosts.

For the routing you also use the 169.254 address as the next hop.

Regards, Maarten
0 Kudos
Gaurav_Pandya
Advisor

Hi Maarten,

Thanks.

I have given IP address to VTI other than interface IP. We can also give private IP address as well. Now Tunnel is UP and working as expected.

I have also enabled OSPF and it is running fine.

0 Kudos
Maarten_Sjouw
Champion
Champion

Gaurav,

A while back I have created a template to be filled for a set of AWS tunnels with or without cluster, with or without BGP and this looks like this, below is the actual code created by the program:

Non cluster version

Cluster version:

This template was built with Filemaker Pro all you fill is the fields on the left top all the rest is filled based on that info.

Regards, Maarten
Gaurav_Pandya
Advisor

Hi Maarten,

Really appreciated.

0 Kudos
watermanns
Explorer

Hi Maarten,

thank you for sharing this good stuff. But I still don't get what the the AWS cluster IP addresses are meaning (100.100.*) and how those addresses are being used in the vpn tunnels 1 and 2 using different networks (local and remote) which is 100.100.* and 169.254.* addresses on numbered tunnel interface. I would expect a /30 network or at least the same network addresses on tunnel interfaces on prem and on AWS side. This still confuses me. Can you please explain this a bit more? Really appreciated.

Many thanks in advance!

Kind regards,

Stefan

0 Kudos
Gaurav_Pandya
Advisor

Hi,

I am summarizing the steps of route based VPN configuration so it will be helpful for others.

  1. Create empty encryption domains and assign to each gateway.
  2. Create VTI interface in Gaia webUI.  for remote peer use object name rather than IP.
  3. Add routes for remote side encryption domain toward VTI interface. - Here you can use static or any other dynamic routing protocol like OSPF.

Enabled OSPF on VTI interface

You can follow sk113735 for point 1-3 configuration. Please note that you can use any fake IP address as Local & Remote addresses.

  1. Fetch topology on gateway object in SmartDashboard.
  2. Add VIPs if cluster.
  3. Use the external interfaces in link selection.
  4. Add rules with directional VPN: source real encryption domains (not null domain), dest same, VPN column: internal_clear to VPN Community, VPN Community to VPN Community, and VPN Community to internal_clear in each VPN rule.

  1. Fw monitor shows little o go to VTI, and big O go to external interface, with external IP's.
Dami
Explorer

Thank you man for sharing... Life saver!

0 Kudos
armandxhafa
Explorer

Hi Gaurav_Pandya, but if we want to add WAN redundancy links, should we do other configurations ?
0 Kudos
Di_Junior
Advisor
Advisor

Hi there

 

Are these steps also applicable if doing route based vpn with Cisco?

 

thanks in advance

0 Kudos
sunilspj
Explorer

Hi,

I have Policy based VPN already running on Checkpoint FW.

Can I create route based VPN also in same FW ?

Can we create route based VPN in virtual FW (VS) ?

0 Kudos
Timothy_Hall
Legend Legend
Legend

Can I create route based VPN also in same FW ?

Yes but policy/domain-based VPN will take precedence for identifying interesting traffic.  See my response here:

https://community.checkpoint.com/t5/Access-Control-Products/Site-to-Site-VPN-policy-based-and-routin...

Can we create route based VPN in virtual FW (VS) ?

No, VSX does not support the VPN Tunnel Interfaces (VTIs) that are required for route-based VPN, see sk79700: VSX supported features on R75.40VS and above.

 

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events