Remote Acces VPN from LAN and WAN

[KingMar]

Hello,

I’m new to the Check Point solution. I’ve started by reading the admin manual, but I couldn’t find an answer to my question, nor could I find relevant information in existing topics, partly due to the language barrier. Thank you for your understanding and for pointing me to the right resources if needed.

Here’s the issue I’m facing:

Currently, the remote access VPN works perfectly for users connecting from outside the corporate network.

However, we’ve encountered a problem recently. Some of our users who travel to a partner site cannot access the network because the partner site refuses to act as their ISP. After implementing the architecture (as shown in the attached diagram), we set up an IPsec tunnel with the partner site so that users can connect back to our network by setting up the VPN client on their devices and connecting to our gateway.

The problem is that the VPN domain for these users, which should be coming from the firewal external zone, is now originating from the internal zone, triggering anti-spoofing.

I considered adding the subnet assigned to the VPN clients in the interface topology and marking it as non-antispoofing. However, this apparently disrupts connectivity for external users connecting via the VPN, which is not acceptable.

I read somewhere that adding a second VPN domain to the default Remote Access community might solve the issue, but I’m not sure how to approach this.

Thank you in advance for your help, CheckMates!

Best regards,

[the_rock]

Hey @KingMar 

Just to make sure I understand this correctly...you are saying there is now S2S vpn tunnel between partner location and your corporate infrstaructure and that works okay? If so, then there would be no need for users to connect withvpn client. Now, if there are anti spoofing errors, I would ensure to maybe exempt those subnets from anti spoof checks on external interface (its under gw object in smart console, network topology tab).

If I misunderstood, happy to do remote and help.

Let me know.

Andy