Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
KingMar
Participant

Remote Acces VPN from LAN and WAN

Hello,

 

I’m new to the Check Point solution. I’ve started by reading the admin manual, but I couldn’t find an answer to my question, nor could I find relevant information in existing topics, partly due to the language barrier. Thank you for your understanding and for pointing me to the right resources if needed.

Here’s the issue I’m facing:

Currently, the remote access VPN works perfectly for users connecting from outside the corporate network.

However, we’ve encountered a problem recently. Some of our users who travel to a partner site cannot access the network because the partner site refuses to act as their ISP. After implementing the architecture (as shown in the attached diagram), we set up an IPsec tunnel with the partner site so that users can connect back to our network by setting up the VPN client on their devices and connecting to our gateway.

The problem is that the VPN domain for these users, which should be coming from the firewal external zone, is now originating from the internal zone, triggering anti-spoofing.

I considered adding the subnet assigned to the VPN clients in the interface topology and marking it as non-antispoofing. However, this apparently disrupts connectivity for external users connecting via the VPN, which is not acceptable.

I read somewhere that adding a second VPN domain to the default Remote Access community might solve the issue, but I’m not sure how to approach this.

 

Thank you in advance for your help, CheckMates!

 

Best regards,

0 Kudos
16 Replies
the_rock
Legend
Legend

Hey @KingMar 

Just to make sure I understand this correctly...you are saying there is now S2S vpn tunnel between partner location and your corporate infrstaructure and that works okay? If so, then there would be no need for users to connect withvpn client. Now, if there are anti spoofing errors, I would ensure to maybe exempt those subnets from anti spoof checks on external interface (its under gw object in smart console, network topology tab).

If I misunderstood, happy to do remote and help.

Let me know.

Andy

0 Kudos
KingMar
Participant

Hello @the_rock ,

Thank you for your response.

To confirm, the IPsec S2S tunnel between the partner site and our infrastructure is functioning correctly.

However, the firewall hosting the IPsec tunnel is not the Check Point. Instead, the traffic is NATed from a VLAN of the second firewall (hosting the IPsec S2S tunnel with the partner site) towards our Check Point, which handles the client-to-site VPN for our remote users.

Additionally, the partner site provides only a secure zone dedicated to our users when they are on-site. It functions essentially as a secure access point without internet. For internet access (the goal), users must activate their VPN as usual. The traffic then flows through the IPsec S2S tunnel between the partner site and our second firewall, is NATed to the Check Point, and subsequently establishes the client-to-site VPN session. we need to make this process seamless and transparent for the users.

I hope this explanation clarifies the setup. Please let me know if you need further details or have any suggestions.

 

Best regards,

0 Kudos
the_rock
Legend
Legend

I will logically assume that this is split tunnel setup where people need to use their own ISP for Internet traffic? If thats the case, then it would "fall" onto wherever they are located for that part, if you will.

Andy

0 Kudos
KingMar
Participant

Hello Andy,

No, that’s not the case. The goal is to provide users with internet access exclusively through the VPN to ensure that traffic is secured and monitored effectively.

Let me know if you need more details about the setup.

 

Best regards,

0 Kudos
the_rock
Legend
Legend

But then, if thats the case, did you ensure that access is properly allowed through CP fw? Because sounds it would be full tunnel set up, so VPN site to site would not matter here.

Andy

0 Kudos
KingMar
Participant

Hi Andy,

The purpose of the IPSec tunnel is simply to connect the two sites. After that, users are required to establish a client VPN to access the internet. We do not want anyone who directly plugs in from the partner site to have unrestricted access to our resources.

Best regards,

0 Kudos
the_rock
Legend
Legend

Ok, thats fine, but maybe we are not on the same page here, as they say lol

Here is what Im trying to say and apologies if its not clear. To me, based on what you explained, it sounds like this is 100% full tunnel, meaning users would NOT use their own ISP to connect online, but rather once connected to VPN, their Internet connection would go through the firewall, correct?

If answer to that question is yes, then what I was implying in my last response is that you would need to make sure traffic is properly allowed via the rule base so they can do so.

Andy

0 Kudos
KingMar
Participant

To clarify, yes, the outbound internet rules are fine since users can already access the internet when connecting from home. The issue, as I mentioned earlier, is that the VPN tunnel drops after about 5 seconds when a user connects from the LAN, whether from my LAN or the VLAN at the partner's site. That’s the main problem we're facing.

 

Best regards

0 Kudos
the_rock
Legend
Legend

Okay, I get it now, sorry for misunderstanding on my part. Anyway, here is what I would suggest. I am with @PhoneBoy as far as disabling anti-spoofing (it would be a good test for the involved interface in question), BUT, I would also refer to below sk about it, since lots of people confuse anti spoofing and address spoofing, as those are 2 different things.

Andy

https://support.checkpoint.com/results/sk/sk115276

0 Kudos
KingMar
Participant

Unfortunately another important point from where my request to the community is that we have a contractual problem with the subcontractor, so I cannot see this sk.

I will try to see if I can get the agreement to deactivate the antispoofing momentarily just to test as mentioned by @PhoneBoy 

the_rock
Legend
Legend

Its not super important you cant see the sk, I just wanted to point out the difference between the 2. Anywho, if you can temporarily disable antispoofing, it would definitely help you eliminate that as a possible issue.

Andy

0 Kudos
PhoneBoy
Admin
Admin

The actual error messages you're seeing (with sensitive details redacted) might help as would version/JHF level.
The only thing I can suggest is using an Office Mode pool that is NOT in your internal address space. 

0 Kudos
KingMar
Participant

Hi PhoneBoy,

Here is the error message: the IP pool address assigned to our client VPN is not used within the LAN. It is specifically designated for clients connecting via the VPN from their PCs. Additionally, we are using Office Mode.

We are running version 81.20 (up to date with Take 89).

Best regards,

 

Best regards

0 Kudos
PhoneBoy
Admin
Admin

What does eth2-01 connect to?
I suspect the quickest fix for this is to disable Anti-Spoofing.
If you haven't already, I'd open a TAC case.

0 Kudos
KingMar
Participant

it is the interconnection between the checkpoint and the firewall Back, management does not want us to deactivate antispoofing

0 Kudos
the_rock
Legend
Legend

Not permanently of course, but just as a test.

Andy

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events