Establish S2S tunnel over LAN

[faaram]

Hello 

Does Checkpoint support creating S2S tunnel over LAN interface? If yes, Does it need a specific configuration, or will it automatically route traffic based on remote peer information and a routing table(directly attached network)? 

[the_rock · Accepted solution]

Its not common, but I believe it does work. I had seen people do it before...you would need to ensure that VPN link selection is correct and other side can communicate with LAN ip address over the Internet, meaning correct NAT would have to be in place (assuming it is over the Internet)

Andy

[faaram]

Hi the_rock,

Thank you for the reply. To clarify, the traffic is not going to go over the Internet. Two routers are going to be connected over a local network, there can be multiple switches in between, but peers are going to be in the same subnet(directly connected).
Why I need tunnel in the local network? Because that "local network" doesn't belong to me and I need to encrypt data passing it.

So the main question is whether there is a limitation in checkpoint to pass traffic only through the wan port.

[the_rock]

100% you can fo that. I actually worked with a customer who has 10 tunnels like that and they all work fine. Just make sure link selection is good to go. I will send you a screenshot tomorrow.

[the_rock]

So, here it is, as promised. So, let me explain briefly what this is what I outlined. Lots of customers have wrong interpretation about what these fields actually mean. So, top section means thats what PEER would see, NOT what CP would send, unlike bottom section, which refers to what CP sends. Now, if you think about it logically, in your case, it makes sense to select 2nd option I marked (in this case, it would probe all available links, so if one is not available, it would probe next one and so on, till it finds one that responds). This is also most logical, given the situation, as you may have tunnels going over the Internet, like customer I was telling you about, and for them, everything works just right with this setting.

If something is still unclear, we can do remote and I will show you.

Andy

• • High Availability (default setting) - In High Availability mode the VPN tunnel uses the first IP address to respond, or the primary IP address if a primary IP is configured and active. If the chosen IP address stops responding, the connection fails over to another responding IP address. If a primary IP address is configured, the VPN tunnel will stay on the backup IP address until the primary one becomes available again.
  • Load Sharing - In Load Sharing mode the encrypted traffic is distributed among all available links. Every new connection ready for encryption uses the next available link in a round robin manner. When a link becomes unavailable, all of its connections are distributed among the other available links. A link's availability is determined using RDP probing.

    The peer Security Gateway that responds to the connection will route the reply traffic through the same route that it was received on, as long as that link is available.