Create a Post
Showing results for 
Search instead for 
Did you mean: 

VPN and three sites


Three sites (1, 2, 3) all running R77.30.

Site2 acts a VPN hub, with both Site1 and Site3 having tunnels (to center only) established to Site2.

Encryption domains:


We're trying to access Site3 from Site1 with the NAT rule on Site2:

Original Source:
Original Destination:
Translated Source: (Hide)
Translation Destination: (Hide)

Is this the right way to do it?

The NAT rule works. We see traffic encrypted from to, but from to, according to the tracker, it's sent in a clear text (just says Accept), although the rule number is correct and it's set to encrypt anything from to using Site2-to-Site3 VPN community.

Thank you.

3 Replies

Why would you do Natting?

First of all, what type of VPN community did you use, when you use a single Star topology just set the tunnel routing to route through center to other satellites.

Problem you run into is that the Gateway is handling the traffic as it sources from to as NATting takes place after the tunneling is handled, the traffic will only be tunneled when you enable the route through center.

Regards, Maarten

Many thanks Maarten Sjouw‌.

I was confused about NATting order. So "route through center to other satellites" should be set on Site2 for both Site1 and Site2 communities, right?

And when it comes to the fw rule on Site2, what VPN Match Condition should be used? Any connections, or Only connections encrypted in specific VPN Communities with Site1 and Site2 communities selected?

0 Kudos

You only create 1 star community and add site2 as the center and site1 and 3 as spokes, however, if you want all sites to be able to talk to each other directly you create a Mesh community and add all 3 sites to it.

I really don't use the VPN column in the rulebase. Are there specific reasons that site 1 cannot talk to site3 directly without natting? If not, don't. 

The whole VPN setup with Check Point is really simple, any site added to a community will allow traffic between those sites, based on the rulebases. When you do need to NAT between site 1 and site 3 better do it on the site 1 FW directly and don't send traffic through 2 tunnels when you can send it through 1.

Regards, Maarten


Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events