- CheckMates
- :
- Products
- :
- General Topics
- :
- Re: Tunnel mode VPN and Transport mode VPN
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Tunnel mode VPN and Transport mode VPN
Does Checkpoint support only Tunnel mode VPN only or we can use Transport mode as well for IPSEC...?
can we switch between them?
Any documentation can we get it on this to get the clarity with example...?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Pretty sure Check Point does not support Transport Mode (which is essentially AH only) and never has. Transport Mode only provides the Integrity (SHA1/MD5/SHA256) and Authenticity (digital signatures) elements of the CIA model, while ESP adds in the Confidentiality piece (3DES/AES-XXX) along with the tunneling/encapsulation functionality. All modern VPNs use ESP, but VPNs with Verizon corporate still call for the use of Transport Mode for some reason.
In the old days on other vendors it was possible to use just AH in transport mode without ESP. This provided Integrity & Authenticity for the payload/data portion of an IP packet only with no encryption; the packet headers would be left intact and the entire packet would not be tunneled. This would save on encryption overhead when CPUs were much slower than they are today however good ol' Moore's Law has rendered this concern mostly moot.
Inevitably I would be asked for an example during a Check Point class about why in the heck you wouldn't want to encrypt the packet with ESP and achieve confidentiality; the best example I could come up with were real-time stock quotes. You sure as heck don't want someone to spoof them or tamper with them and as a result have your computer-based trading go awry, but you don't especially care if a man in the middle can see the quotes since they are more or less public information. Read the Wikipedia article about Knight Capital for a graphic description of how a prominent high frequency trading firm was essentially bankrupted in the space of 45 minutes by automated trading errors.
--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.
now available at maxpowerfirewalls.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are You sure about it.
How would You explain situation when IPSec SA is set to NULL for IKE Phase 2?
Sincerely
PT
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Setting the Phase 2 Encryption to NULL does not cause Transport Mode to be used, it simply disables encryption of traffic traversing the VPN tunnel. The entire original packet is still tunneled by ESP and digitally signed.
Transport mode encrypts just the payload of the original packet and leaves the original packet header intact with no tunneling.
There are references to "Transport Mode" scattered throughout the Check Point VPN documentation, but they refer to supporting Transport Mode for Remote Access via L2TP and also GRE. Transport Mode is not supported for site-to-site VPN.
--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.
now available at maxpowerfirewalls.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry Tim, I was thinking about enforcing AH only mode in Tunnel Mode. I was thinking this would disable ESP and leave only AH part of IPSec.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@Tim Hall
I have a issue on transport Mode via GRE. Toplogy is:
peer 1 ------- checkpoint ---- VPN ---- cisco ASA ----- peer2
Peer 1 and Peer 2 has GRE VPN connection. Checkpoint with ASA firewall connected NAT-T Site2Site vpn.
Both peer routers are connecting. But GRE tunnel doesn't work.
Is it possible to connect gre tunnel?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Pretty sure GRE inside an IPSec tunnel is supported, although I can't recall ever setting one up. Is the Check Point side a cluster? If so could this be your issue: sk90060: GRE tunnel stops working inside a Site-to-Site VPN tunnel established with Check Point clus...
--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com
now available at maxpowerfirewalls.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you,
Checkpoint Side is cluster. Packets were coming in clear text and checkpoint dropping it.
We tried without VPN. Checkpoint has direct connected ASA and we created static route. Certainly, both peers are can connect each other.
peer 1 ------- checkpoint ---- Direct Optic Link(without VPN) ---- cisco ASA ----- peer2
It hasn't dropp log, but still couldn't establish.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't think this is the case, the part of the SK you are quoting is describing the theoretical elements of IPSec, not what can actually be configured. There is no way to set an IPSec tunnel to use Transport mode that I can find, and Tunnel mode is the default. I'd love to be proven wrong...
now available at maxpowerfirewalls.com