Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
BSBhatia
Participant
Jump to solution

Site-To-Site connectivity and application access

Hi

After migration to checkpoint firewall 5900 (R80.10) at two geographically separated sites, network access from one site to another does not work, when the tunnel terminating on the edge routers of the two sites is in place. But as soon as the tunnel is removed between the two edge routers network access is enabled and applications across the sites become accessible.

Kindly help to fix the issue.

Thanks

BS Bhatia

 

0 Kudos
1 Solution

Accepted Solutions
PhoneBoy
Admin
Admin

If I'm understanding this correctly, you have routers between the two Check Point gateways doing an IPSec tunnel between the two sites, correct?
Generally, that's going to cause MTU issues.
What I suspect is happening is the following:

  • Large packet comes through Gateway A with the Don't Fragment Bit set
  • When that large packet hits the router and it tries to go through the IPsec tunnel, the packet + IPsec header will be larger than the MTU
  • The router is sending back an ICMP message back saying "Fragmentation Needed" which is getting dropped at the firewall

The end result is traffic doesn't work.
You can easily confirm all of the above with tcpdump or similar.

The solution is pretty simple: configure the access policy to allow ICMP Fragmentation Needed packets from the router.

View solution in original post

4 Replies
Nick_Doropoulos
Advisor

Hi Bhatia,

Would you mind sharing with us a basic diagram of your topology?

Many thanks.

Nicholas

0 Kudos
BSBhatia
Participant

The topology diagram is attached as file "Diagram.docx".

 

PhoneBoy
Admin
Admin

If I'm understanding this correctly, you have routers between the two Check Point gateways doing an IPSec tunnel between the two sites, correct?
Generally, that's going to cause MTU issues.
What I suspect is happening is the following:

  • Large packet comes through Gateway A with the Don't Fragment Bit set
  • When that large packet hits the router and it tries to go through the IPsec tunnel, the packet + IPsec header will be larger than the MTU
  • The router is sending back an ICMP message back saying "Fragmentation Needed" which is getting dropped at the firewall

The end result is traffic doesn't work.
You can easily confirm all of the above with tcpdump or similar.

The solution is pretty simple: configure the access policy to allow ICMP Fragmentation Needed packets from the router.

BSBhatia
Participant

Thanks a lot for the solution.

After reducing the MTU on firewall interface connected to the edge router at both the ends (to 1320), network access across the sites is working fine. 

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events