This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
ABOUT CHECKMATES CYBER SECURITY COMMUNITY & FAQ
Create a Post
Help
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

Are you a member of CheckMates?

×
Sign in with your Check Point UserCenter/PartnerMap account to access more great content and get a chance to win some Apple AirPods! If you don't have an account, create one now for free!
This widget could not be displayed.
6 Replies
This widget could not be displayed.
Preview file
132 KB

Trying to setup a subnet for Endpoint Client VPN connections.  My question is, where do I define the gateway interface for the network I'm creating? I'm assuming that the endpoint client vpn network would live entirely on the Check Point gateways.  Where would I create the virtual interface for this subnet?  See diagram attached.  I am using Office Mode Method Manual (using IP Pool).

Network:   192.168.7.0/24

Gateway:  192.168.7.1

VPN Client IP Pool

IP:            192.168.7.50-100

Mask:       255.255.255.0

Gateway: 192.168.7.1

Thanks for the look!

Preview file
132 KB

Creating subnet for VPN client traffic in Cluster deployment?

Creating subnet for VPN client traffic in Cluster deployment?

Creating subnet for VPN client traffic in Cluster deployment?

Trying to setup a subnet for Endpoint Client VPN connections.  My question is, where do I define the gateway interface for the network I'm creating? I'm assuming that the endpoint client vpn network would live entirely on the Check Point gateways.  Where would I create the virtual interface for this subnet?  See diagram attached.  I am using Office Mode Method Manual (using IP Pool).

Network:   192.168.7.0/24

Gateway:  192.168.7.1

VPN Client IP Pool

IP:            192.168.7.50-100

Mask:       255.255.255.0

Gateway: 192.168.7.1

Thanks for the look!

Preview file
132 KB

Trying to setup a subnet for Endpoint Client VPN connections.  My question is, where do I define the gateway interface for the network I'm creating? I'm assuming that the endpoint client vpn network would live entirely on the Check Point gateways.  Where would I create the virtual interface for this subnet?  See diagram attached.  I am using Office Mode Method Manual (using IP Pool).

Network:   192.168.7.0/24

Gateway:  192.168.7.1

VPN Client IP Pool

IP:            192.168.7.50-100

Mask:       255.255.255.0

Gateway: 192.168.7.1

Thanks for the look!

Preview file
132 KB

Trying to setup a subnet for Endpoint Client VPN connections.  My question is, where do I define the gateway interface for the network I'm creating? I'm assuming that the endpoint client vpn network would live entirely on the Check Point gateways.  Where would I create the virtual interface for this subnet?  See diagram attached.  I am using Office Mode Method Manual (using IP Pool).

Network:   192.168.7.0/24

Gateway:  192.168.7.1

VPN Client IP Pool

IP:            192.168.7.50-100

Mask:       255.255.255.0

Gateway: 192.168.7.1

Thanks for the look!

Preview file
132 KB
0 Kudos
0 Kudos
0 Kudos
Timothy_Hall
MVP Gold
MVP Gold
‎2017-11-28 04:05 PM
Timothy_Hall
MVP Gold
MVP Gold
‎2017-11-28 04:05 PM
Timothy_Hall
MVP Gold
MVP Gold
‎2017-11-28 04:05 PM
In response to Nick_Burris
In response to Nick_Burris
In response to Nick_Burris

Hi Nick,

You must be thinking of how Palo Alto and some other vendors set up a VPN, by creating a "tunnel" interface and putting an IP address on it to represent the firewall.  Check Point is capable of this same route-based VPN setup using VPN Tunnel Interfaces (VTIs) for site-to-site VPNs. 

For remote access VPN on Check Point there is no tunnel interface or virtual adapter.  When you set the subnet for assignment to VPN clients via Office Mode in the SmartConsole/SmartDashboard, the firewall will automatically take the lowest numbered address (usually .1) and propagate that as the gateway to the VPN client.  Just make sure that the subnet handed out by Office Mode to the clients does not exist anywhere in your inside network, and will be routed back to the firewall/Internet and you should be good.

New Book: "Max Power 2026" Coming Soon
Check Point Firewall Performance Optimization

Hi Nick,

You must be thinking of how Palo Alto and some other vendors set up a VPN, by creating a "tunnel" interface and putting an IP address on it to represent the firewall.  Check Point is capable of this same route-based VPN setup using VPN Tunnel Interfaces (VTIs) for site-to-site VPNs. 

For remote access VPN on Check Point there is no tunnel interface or virtual adapter.  When you set the subnet for assignment to VPN clients via Office Mode in the SmartConsole/SmartDashboard, the firewall will automatically take the lowest numbered address (usually .1) and propagate that as the gateway to the VPN client.  Just make sure that the subnet handed out by Office Mode to the clients does not exist anywhere in your inside network, and will be routed back to the firewall/Internet and you should be good.

New Book: "Max Power 2026" Coming Soon
Check Point Firewall Performance Optimization

Hi Nick,

You must be thinking of how Palo Alto and some other vendors set up a VPN, by creating a "tunnel" interface and putting an IP address on it to represent the firewall.  Check Point is capable of this same route-based VPN setup using VPN Tunnel Interfaces (VTIs) for site-to-site VPNs. 

For remote access VPN on Check Point there is no tunnel interface or virtual adapter.  When you set the subnet for assignment to VPN clients via Office Mode in the SmartConsole/SmartDashboard, the firewall will automatically take the lowest numbered address (usually .1) and propagate that as the gateway to the VPN client.  Just make sure that the subnet handed out by Office Mode to the clients does not exist anywhere in your inside network, and will be routed back to the firewall/Internet and you should be good.

New Book: "Max Power 2026" Coming Soon
Check Point Firewall Performance Optimization
0 Kudos
0 Kudos
0 Kudos
Nick_Burris
Participant
‎2017-11-30 12:21 PM
Nick_Burris
Participant
‎2017-11-30 12:21 PM
Nick_Burris
Participant
‎2017-11-30 12:21 PM
In response to Timothy_Hall
In response to Timothy_Hall
In response to Timothy_Hall

Hi Tim,

Thank you for the clarification.  You are correct!  As a new customer, I'm unfamiliar with the way Check Point goes about configuring remote access VPN.  It has been tricky trying to find documentation on this, so I appreciate the input.  The Office mode subnet exists entirely on the Check Point side.  That subnet is not defined on my internal network.  Thanks again.

Hi Tim,

Thank you for the clarification.  You are correct!  As a new customer, I'm unfamiliar with the way Check Point goes about configuring remote access VPN.  It has been tricky trying to find documentation on this, so I appreciate the input.  The Office mode subnet exists entirely on the Check Point side.  That subnet is not defined on my internal network.  Thanks again.

Hi Tim,

Thank you for the clarification.  You are correct!  As a new customer, I'm unfamiliar with the way Check Point goes about configuring remote access VPN.  It has been tricky trying to find documentation on this, so I appreciate the input.  The Office mode subnet exists entirely on the Check Point side.  That subnet is not defined on my internal network.  Thanks again.

0 Kudos
0 Kudos
0 Kudos
Heath
Collaborator
‎2017-12-03 08:58 PM
Heath
Collaborator
‎2017-12-03 08:58 PM
Heath
Collaborator
‎2017-12-03 08:58 PM
In response to Nick_Burris
In response to Nick_Burris
In response to Nick_Burris

We were in the same boat. Moving from a life with Cisco to Check Point was really hard and we are still struggling with the remote VPN. We had a very complex remote access that was very granular for access and the move has taken time to work through.

I'd like to see a document that shows migrations from other vendor setups to Check Point as far as remote access VPN goes. I think these details could be used in the technical side as well as the sales side.

We were in the same boat. Moving from a life with Cisco to Check Point was really hard and we are still struggling with the remote VPN. We had a very complex remote access that was very granular for access and the move has taken time to work through.

I'd like to see a document that shows migrations from other vendor setups to Check Point as far as remote access VPN goes. I think these details could be used in the technical side as well as the sales side.

We were in the same boat. Moving from a life with Cisco to Check Point was really hard and we are still struggling with the remote VPN. We had a very complex remote access that was very granular for access and the move has taken time to work through.

I'd like to see a document that shows migrations from other vendor setups to Check Point as far as remote access VPN goes. I think these details could be used in the technical side as well as the sales side.

0 Kudos
0 Kudos
0 Kudos
Norbert_Bohusch
Advisor
‎2017-12-05 01:21 AM
Norbert_Bohusch
Advisor
‎2017-12-05 01:21 AM
Norbert_Bohusch
Advisor
‎2017-12-05 01:21 AM

The so called "office mode network" has to be defined in all gateways which are part of the cluster.

If you have an active/standby cluster, it is best practice to use same subnet for both.

All addresses of this subnet are assigned to the users connecting. None is really used as gateway address, but on the clients it will take one near the actual address as gateway.

So a client getting 192.168.7.1 in your environment will have gateway set to .2. But client getting 192.168.7.2 will have gateway set to .1, but don't mind this! It works anyway 😉

The so called "office mode network" has to be defined in all gateways which are part of the cluster.

If you have an active/standby cluster, it is best practice to use same subnet for both.

All addresses of this subnet are assigned to the users connecting. None is really used as gateway address, but on the clients it will take one near the actual address as gateway.

So a client getting 192.168.7.1 in your environment will have gateway set to .2. But client getting 192.168.7.2 will have gateway set to .1, but don't mind this! It works anyway 😉

The so called "office mode network" has to be defined in all gateways which are part of the cluster.

If you have an active/standby cluster, it is best practice to use same subnet for both.

All addresses of this subnet are assigned to the users connecting. None is really used as gateway address, but on the clients it will take one near the actual address as gateway.

So a client getting 192.168.7.1 in your environment will have gateway set to .2. But client getting 192.168.7.2 will have gateway set to .1, but don't mind this! It works anyway 😉

0 Kudos
0 Kudos
0 Kudos