Multiple VTI tunnels with BGP to third party from Quantum Spark - no SmartConsole or Communities

[ITSOU-SVC]

Hi all,

Checkpoint Noob here.  Have been tasked with configuring a Spark 1570 running R81.10.10 - Build 945.

Requires:

Third party has 2 IPs so we need two tunnels.

BGP required, therefore VTI required.

I do not have access to SmartConsole (that I know of) or Communities (that I know of - is that an add-on product?)

I feel like the setup is going to be very similar to this:

https://support.checkpoint.com/results/sk/sk108958?source=sf&permanentid=baa13175f30b7728dd338ab071c...

I used the above guide to setup the tunnels successfully in Gaia but I don't have access to the SmartConsole to configure the Interoperable device (is not a object type in Gaia GUI).  I created a normal host object instead - don't know if that's going to work.

I don't have Communities apparently with the license for this device so I cannot setup the communities part. Can that portion be setup using Gaia command line?  

Am I going to have to figure out how to add a license to use Communities?  Feeling very ignorant at the moment.

Thanks.

[G_W_Albrecht]

You use a loclly managed Spark 1570 running R81.10.10, so you have no SmartConsole and only Embedded GAiA.

Documentation:

• Quantum Spark 1500, 1600, 1800, 1900, and 2000 Appliance Series R81.10.X Release Notes

• Quantum Spark 1500, 1600, 1800, 1900, and 2000 Appliance Series R81.10.X Locally Managed Administrat...

Better look here for VPN with AWS:  sk111733: How to configure Site-to-Site VPN between Amazon Web Services and locally managed SMB appl...

Besides: Can we move this post to Spark/SMB, @PhoneBoy , @_Val_ ?

[ITSOU-SVC · Accepted solution]

Was able to engage Check Point support. It turns out that in our case to use the redundant tunnels we need to use MEP, which can be used with DPD instead of RDP (Check Point proprietary), however, to use MEP with our device requires centrally managed system like SmartConsole.  We are going to work with the third party to just use a single tunnel. 😞

[PhoneBoy · Accepted solution]

VPN Communities and Interoperable Objects are only relevant when managed with a Smart-1, which is not the case for a locally managed device.
You can set up VTIs in Device > Network > Local Network > New > VPN Tunnel (VTIs).
You can set up the peer in VPN > Site to Site > VPN Sites.