Multiple IPsec Tunnel Configuration - Checkpoint SMB

[khineminn]

Hello Dears,

I would like to create two tunnels with peer sides and allow separate local encryption domain IPs for each tunnel as follows (I don't want to use the full subnet).

Tunnel 1 - Local ED 192.168.1.100 Remote ED 10.10.10.0/24
!
Tunnel 2 - Local ED 192.168.1.200 Remote ED 10.20.30.0/24

I think the configuration for Remote ED is okay and it's with dedicated VPN sites. However, for Local ED, I have no idea how to configure it and how to separate it for each tunnel.

[CaseyB]

As long as you are on R80.40+, you can use granular encryption domains to accomplish this task.

• Local FW - Build a network group with the two local ED IP's defined as /32 subnets.
• Remote FW - Build a network group with the two remote subnets.
• Build a mesh / start VPN community and use the above created network groups as the granular encryption domains and leave it as subnet to subnet IKE exchange.
• Create FW rules as needed.

[khineminn]

We are using Checkpoint Spark SMB 1800 with R81.10.10 and local management. Is there any configuration example to setup like multiple tunnels.

[CaseyB]

I am not familiar with local management configuration of the SMB devices. If I had a spare SMB gateway, I could probably mock something up real quick, but none of my current SMB devices run R81.10.

[PhoneBoy]

If this is locally managed, you're probably going to have to hack .def files to achieve the desired result, for example Option 1 in: https://support.checkpoint.com/results/sk/sk108600