- Products
- Learn
- Local User Groups
- Partners
-
More
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
IDC Spotlight -
Uplevel The SOC
Important! R80 and R80.10
End Of Support around the corner (May 2021)
Hi,
I am trying to establish route based VPN and I have created numbered VTIs on both firewalls with help of SK113735. But traffic is going in clear text, it is not encrypting traffic.
Please let me know if any other setting, creating community etc. needs to be done.
Gaurav,
Please review the second portion of this How to configure IPsec VPN tunnel between Check Point Security Gateway and Amazon Web Services VPC u...
to see the creation of the VPN community for route-based VPNs. It should be more broadly applicable than just AWS.
Cheers,
Vladimir
Thanks Vladimir for the response.
I will try it to configure.
Hi,
I have configured route based VPN but tunnel is not coming UP. fails at phase1. Just want to confirm that I have configured VTIs in correct manner.
Environment : Single GW (Not in cluster)
VTI : Local address - Public IP of My GW (External IP)
Remote address - Public IP of Remote GW (External IP)
Static Route : Next hope is Public IP of Remote GW.
As I said in my post have a look at the first image, in the top left you enter the 169.254 addresses you get for local and remote, the look at the first lines of the CLISH code which configures the VTI's it shows you the 169.254 addresses, not the real IP's of the hosts.
For the routing you also use the 169.254 address as the next hop.
Hi Maarten,
Thanks.
I have given IP address to VTI other than interface IP. We can also give private IP address as well. Now Tunnel is UP and working as expected.
I have also enabled OSPF and it is running fine.
Gaurav,
A while back I have created a template to be filled for a set of AWS tunnels with or without cluster, with or without BGP and this looks like this, below is the actual code created by the program:
Non cluster version
Cluster version:
This template was built with Filemaker Pro all you fill is the fields on the left top all the rest is filled based on that info.
Hi Maarten,
Really appreciated.
Hi,
I am summarizing the steps of route based VPN configuration so it will be helpful for others.
Enabled OSPF on VTI interface
You can follow sk113735 for point 1-3 configuration. Please note that you can use any fake IP address as Local & Remote addresses.
Thank you man for sharing... Life saver!
Hi there
Are these steps also applicable if doing route based vpn with Cisco?
thanks in advance
Hi,
I have Policy based VPN already running on Checkpoint FW.
Can I create route based VPN also in same FW ?
Can we create route based VPN in virtual FW (VS) ?
> Can I create route based VPN also in same FW ?
Yes but policy/domain-based VPN will take precedence for identifying interesting traffic. See my response here:
> Can we create route based VPN in virtual FW (VS) ?
No, VSX does not support the VPN Tunnel Interfaces (VTIs) that are required for route-based VPN, see sk79700: VSX supported features on R75.40VS and above.
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY