Remote Acces VPN from LAN and WAN

[KingMar]

Hello,

I’m new to the Check Point solution. I’ve started by reading the admin manual, but I couldn’t find an answer to my question, nor could I find relevant information in existing topics, partly due to the language barrier. Thank you for your understanding and for pointing me to the right resources if needed.

Here’s the issue I’m facing:

Currently, the remote access VPN works perfectly for users connecting from outside the corporate network.

However, we’ve encountered a problem recently. Some of our users who travel to a partner site cannot access the network because the partner site refuses to act as their ISP. After implementing the architecture (as shown in the attached diagram), we set up an IPsec tunnel with the partner site so that users can connect back to our network by setting up the VPN client on their devices and connecting to our gateway.

The problem is that the VPN domain for these users, which should be coming from the firewal external zone, is now originating from the internal zone, triggering anti-spoofing.

I considered adding the subnet assigned to the VPN clients in the interface topology and marking it as non-antispoofing. However, this apparently disrupts connectivity for external users connecting via the VPN, which is not acceptable.

I read somewhere that adding a second VPN domain to the default Remote Access community might solve the issue, but I’m not sure how to approach this.

Thank you in advance for your help, CheckMates!

Best regards,

[the_rock]

Hey @KingMar 

Just to make sure I understand this correctly...you are saying there is now S2S vpn tunnel between partner location and your corporate infrstaructure and that works okay? If so, then there would be no need for users to connect withvpn client. Now, if there are anti spoofing errors, I would ensure to maybe exempt those subnets from anti spoof checks on external interface (its under gw object in smart console, network topology tab).

If I misunderstood, happy to do remote and help.

Let me know.

Andy

[KingMar]

Hello @the_rock ,

Thank you for your response.

To confirm, the IPsec S2S tunnel between the partner site and our infrastructure is functioning correctly.

However, the firewall hosting the IPsec tunnel is not the Check Point. Instead, the traffic is NATed from a VLAN of the second firewall (hosting the IPsec S2S tunnel with the partner site) towards our Check Point, which handles the client-to-site VPN for our remote users.

Additionally, the partner site provides only a secure zone dedicated to our users when they are on-site. It functions essentially as a secure access point without internet. For internet access (the goal), users must activate their VPN as usual. The traffic then flows through the IPsec S2S tunnel between the partner site and our second firewall, is NATed to the Check Point, and subsequently establishes the client-to-site VPN session. we need to make this process seamless and transparent for the users.

I hope this explanation clarifies the setup. Please let me know if you need further details or have any suggestions.

Best regards,

[the_rock]

I will logically assume that this is split tunnel setup where people need to use their own ISP for Internet traffic? If thats the case, then it would "fall" onto wherever they are located for that part, if you will.

Andy

[PhoneBoy]

The actual error messages you're seeing (with sensitive details redacted) might help as would version/JHF level.
The only thing I can suggest is using an Office Mode pool that is NOT in your internal address space.