SNMP integration with Check Point using WAN IP | VPN in use

[Firewall_Head]

Dear Checkmates,

R81.10 Gateway

I have two sites A and B which is connected by IPsec VPN, in site B I have my SNMP application with a private IP. I wanted to monitor my Check Point firewall in site A with it's WAN IP which is used for VPN tunnel. 

I tried doing it but failed multiple times.

1> Checked for packet captures >> negative

2> Checked for kernel debugs >>negative

Can anyone help me on this please, I can't exclude snmp service under vpn because it's a weak version that we are using.

+PFA for your reference.

=======

WR,

FH

[AkosBakos]

Hi @Firewall_Head 

Have you tried exclude the SNMP from the Tunnel? 

But this is not the safest setup, but I think you know it.

Akos

[AkosBakos]

UPDATE: you wrote, you can't exclude it. ACK 🙂

What if you set the SNMP config for an IP which is in the ENC_DOM and reachable from site. Create a small VLAN with /29 prefix, and it is avaialable on the GW _only_  (no connection to the intranet) The routing will direct the traffic to that IF -> it should work, but not a beautiful solution.

[Firewall_Head]

Hi @AkosBakos ,

Thanks for your quick update.

Can you please explain it, do you mean to create a Vlan on the gateway and add that ip in the encryption domain of the vpn??

Use that ip for snmp monitoring ?

====

WR,

FH

[AkosBakos]

Hi,

This is only an idea, unfortunately I can't test is yet. Please be cautious.

This is a simple interface modificationm and a VPN Domain extension

 So I would create an IF which exists only on the GW (you need to discuss with the network team for the availabe IPs and VLANs)

You will query the GE on this interface (in this case 192.168.99.1)

Then and it to the ENC_ DOM (VPN Domain)

You need to add it both sides.

Create the neccesary Access Rules.

When the packet arrives to the GW, because the newly created LAN is a connected LAN, the route will direct to that interface (192.168.99.1) the trafic.

Akos

[PhoneBoy]

The WAN IP is automatically included in the encryption domain, which means the traffic will likely be encrypted.
fw monitor should show you if the traffic is being encrypted/decrypted correctly or not.