Domain based VPN, route all traffic through VPN

[olpmdER]

Hello,

We currently have a VSX environment running on version R80.40, which does not support VTI.

Therefore, the only viable solution is to use Domain-based VPN.

Our network configuration is as follows:

Our Networks => CheckPoint Gateway => 3rd Party Gateway (PaloAlto) => Internet

We aim to establish an IPsec VPN between our CheckPoint Gateway and the 3rd Party Gateway, where the tunnel IPs use private addresses.

Our objective is to route all our networks traffic through this VPN to access the internet. 

this setup can be feasible?

We plan to implement a Star Community setup, using the third option in VPN routing, with the 3rd Party Gateway as the Center Gateway and our CheckPoint Gateway as the Satellite. However, on the CheckPoint Gateway, for the VPN domain on our side, we can define our networks, but on the other side, can we specify 0.0.0.0/0 as the VPN domain?  will this configuration work?

Thank you.

[the_rock]

I know 2 customers who did it that way, worked fine, no issues. It was with Cisco and Fortigate, but I dont think that matters at all.

Andy

[the_rock]

Also, I made below post few months back, see if it helps you. Here is IMPORTANT thing to remember...IF you will see UNNUMBERED vti's, which is fine, dont freak out if same IP pops up in topology as actual external IP, as thats totally normal, BUT, do make sure route poits to correct remote subnet and it uses that vti interface.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Route-based-VPN-tunnel-to-Azure/m-p/206179/emc...

[olpmdER]

Thank you, Andy, for your response.

However, this isn't applicable to our implementation since we cannot use VTI. We currently have a VSX environment running on version R80.40, which does not support VTI. Therefore, the only option available to us is a Domain-based VPN.

[the_rock]

Right, I read that part, I was more just sending it for reference. Either way, works fine with domain based, thats what those 2 customers did actually.

Andy

[olpmdER]

Thank you for providing the files; they will be very helpful for us.

We are currently facing a challenge related to encryption domains.
On our side (CheckPoint).
We need to configure our networks in the source domain
In the destination domain : 0.0.0.0/0 and excluding our networks to avoid overlaps.

Regarding the encryption domains from the 3rd Party Firewall:

• Source domain: 0.0.0.0/0, excluding local addresses and CheckPoint networks
• Destination: CheckPoint Networks

=> Our concern is that if we configure it this way, when the 3rd party firewall receives traffic from our side to the internet, will the firewall route it again through the VPN because of the 0.0.0.0/0 configuration in the source side domain?, or will it simply use its own default gateway to route the trafic comming from the VPN to internet.
Thank you.

[the_rock]

It all depends how route is configured, also if you are using VTI, numbered or unnumbered.

Andy

[olpmdER]

We don't use VTI We use only, domain based VPN. 

[the_rock]

Sorry, silly me, keep forgetting. Then make sure regular routes are correct.

[olpmdER]

Your help has been invaluable, So please, feel free to keep forgetting  😂
If the regular route works as expected, our traffic will not return to the VPN due to the 0.0.0.0/0 entry in the source domain of the third-party firewall. Instead, it will route directly to the internet, following the default gateway. Is that correct?

[the_rock]

No worries, we are all here to help mate.

Yes, that statement sounds right. So if regular route works as intended, then thats what it will take precedence. Otherwise, whatever is in the VPN domain would technically go through the tunnel. Makes sense?

Andy

I attached basic example my colleague made while back. I know its generic, but hope its useful.