VPN Mesh over Starlink

[mikefarmer]

I have a VPN mesh between multiple Check Point devices.  The last device which sits behind a Starlink internet route will not establish VPN connection even when aggressive mode is enabled.  Debug is showing me that the IKE identifier is FFFFFF and not the name of the firewall. 

[PhoneBoy]

If Starlink is somehow modifying/corrupting the IKE packets, not sure there's much we can do on our end.

[oa_munich · Accepted solution]

Are you trying to connect via IPv4? If so, Starlink offers two IPv4 policies, "default" and "public":
- The default IPv4 configuration uses Carrier-Grade Network Address Translation (CGNAT) using private address space from the 100.64.0.0/10 prefix assigned to Starlink clients via DHCP - you are sharing one public IP address with multiple other clients, you can NAT to the outside world, but not back
- The Starlink public IPv4 policy is an optional configuration available to Local and Global Priority customers. A public IPv4 is reachable from any device on the Internet and is assigned to Starlink network clients using DHCP.

You have two options, become a priority customer and switch to the "public" policy OR connect via ipv6 - Starlink provides a /56 prefix.

https://www.starlink.com/support/article/13f0056c-6f6d-5a55-623c-fe94ad9947c5

[PhoneBoy]

Thanks for sharing.
Doesn't seem that Starlink is very VPN friendly.
That could be a function of CGNAT for IPv4, though.