Connections to Checkpoint native services do not encrypt within the VPN for firewall management

[jarvis_dantsrib]

Hello, I am facing a problem where connections on service port 18191 and Checkpoint native services are not encrypted within the VPN, as a consequence it is not possible to manage the firewall and install policy of the remote unit via LAN IP.

The interesting thing is that only Checkpoint service traffic is not encrypted, but ICMP, SSH, HTTPS and other non-native services are encrypted within the VPN.

It is possible to see that there is a match in implicit accept rules, but the traffic is encrypted.

[emmap · Accepted solution]

This is by design, the CP service traffic is already encrypted and is required to be working to set up a VPN to a remote device over the internet as you need to install the policy to get the VPN going. As such we don't tunnel it by default. You can change this behaviour, but at your risk.

https://support.checkpoint.com/results/sk/sk104582

[jarvis_dantsrib]

Hello, This SK is not accessible to me

[PhoneBoy · Accepted solution]

The solution (and its implications) are discussed in these two CheckMates threads:

• https://community.checkpoint.com/t5/Management/Exclude-CPM-traffic-from-implied-rules/m-p/3934
• https://community.checkpoint.com/t5/Management/Exclude-CPM-Traffic-from-Implied-Rules/m-p/9187