- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: Feasible Option to send specific traffic to Z...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Feasible Option to send specific traffic to Zscaler- From Checkpoint Gateway
Dear Team,
First question
As i checked in Zscaler Official Website they have given list which is supported Firewall device for IPSEC Tunnel so checkpoint Device not in list ,(So my first question is why checkpoint is not supportable device to build tunnel with Zscaler ) (For GRE I know that checkpoint is not supported this feature)
Secondly ,
My requirement is matching which given diagram which is not exact customer digram but its scenario found from zscaler , So, In My Client environment
GRE Tunnels from the Border Router to the ZENs
Second Diagram JPG
https://help.zscaler.com/zia/gre-deployment-scenarios
ISP ---> ROuter --->IPS (IN L2 Mode)-->SwitchL2-->Checkpoint Device ----> LAN SWICH AND OTHER USERS
In this requirement If Zscaler is making GRE WIth CISCO ROuter RIght so how can i pass traffic to GRE Tunnel Without NAT , Becuase From Router to CP WAN PUblic LAN Pool we are using .and presently i have configured Hide nat to forward traffic of private pool towards Internet (By router)
(Zscaler need to give reporting with Original LAN IP so they want without nat traffic)
So, i dont know if i will disable NAT so traffic will go to router side or not , and If it s done then as per standard i am doing right thing or not can you please suggest me , because outside firewall if we are publishing our local LAN it will be security bridge right .
SO What will be feasible suggestion.
Another option we are thinking is (First option which i mentioned that IPSEC Tunnel between CP to Zscaler) But in this case we need to forward only 80 and 443 port traffic so is not possible becuase as i know PBR is not supported with service based traffic forwarding
Our device in R80.10 and latest one so there is no limitation with update.
Regards,
Harmesh
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are two supported configurations for connecting with Zscaler:
- With GRE: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
- With IPSec: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
This requires the versions specified in the SKs.
The above is not relevant on the SMB appliances running Embedded Gaia and an RFE via your local Check Point office will likely be necessary.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The traffic inside the GRE tunnel won't be NATted here.
Unless I'm misunderstanding the environment.
In which case, an annotated network diagram of the actual environment would be helpful.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If so you can use that between gateway and router and use this external IP to setup the GRE tunnel.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I use a VPN tunnel for many customers for ZScaler proxy:
1) Add an VPN tunnel to ZScaler and add all internet addresses ( 0.0.0.1-223.255,255,255 and exclude privat networks)
2) Exclude your private and other used networks via crypt.def and no vpn traffic rules.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here the sk86582 to no vpn trffic rules:
Excluding subnets in encryption domain from accessing a specific VPN community
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HeikoAnkenbrand, what kinds of device(s) are you terminating the VPN tunnel on and how is performance? We have tested on 1100, 1400 and 4200 with 77.20, 77.30 and 80.20 with poor performance.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you have a more detailed procedure? I'm trying to setup a similar VPN between Checkpoint and Zscaler in order to forward 80/443 to them.
Thanks,
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi HeikoAnkenbrand,
Can you help to explain in more details how to successfully create the tunnel to zscaler proxy?
Here's the environment for your reference.
Example of current configuration
CheckPoint 4800 with existing 3 tunnels to AWS and azure
CheckPoint firewall VPN domain ( 172.16.0.0/16 , 172.18.0.0/16 172.19.1.0/24, 172.24.0.0/16)
before migrating few server subnet to zscaler proxy via ipsec tunnel, we want to test using one IP address only. (172.18.215.10).
what is the step to create the vpn community( mostly the vpn domain for checkpoint fw since we already have vpn domain defined), interoperable device, etc
thanks in advance
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Sir,
Could you please more steps and guidance in order to implement such setup ?
Thanks!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are two supported configurations for connecting with Zscaler:
- With GRE: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
- With IPSec: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
This requires the versions specified in the SKs.
The above is not relevant on the SMB appliances running Embedded Gaia and an RFE via your local Check Point office will likely be necessary.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First of all, I would like to thank you for sharing this, it's very informative!
I still have some questions here and wonder if you could help:
- on section 2.1, what does Group 1 stands for as VPN domain on Zscaler gateway? What would be its definiton ?
- From Checkpoint side, how can we configure different VPN domains for each VPN community ?
- How can we exclude Internal traffic from being forwarded over the tunnel to Zscaler ?
- If we disable NAT on the VPN community, NAT-T enabled on the device level will have no effect ?
- According to Zscaler team, each IPsec tunnel will carry 400Mbits/s, how can we setup 3 active tunnels at the same time to have 1.2Gbit/s
Thank you in advance!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have GRE tunnels setup and working by following sk175385. However, the SK only shows how to create a policy rule using HTTP (80) / TCP (Step 8e). What is the best way to route all ports over the GRE tunnel instead of creating a rule for each port and protocol?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you're routing to Zscaler, they only look at HTTP/HTTPS (as I recall), which is why the SK lists that step.
You should be able to uncheck Service Port and/or Protocol in that step to allow all ports and/or protocols.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The Zscaler engineer we worked with also mentioned that GRE tunnel method should pass traffic more than just http/https; So if we don't specify any port and protocol, it will just pass all right?
If we already have restriction on outbound traffic, do we then still need to configure firewall rule to allow any> any for Zscaler destination?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Zscaler looks at all ports and protocols, not just HTTP/HTTPS. I guess the SK shows those services as that is the most common traffic that is normally sent. I presume a policy rule based on interface or source network can be used instead of service ports/protocols to match on (sk100500) which should theoretically send all traffic over the GRE tunnel.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Heiko, can you post an example of how you did this exclusion in r80.20? ("Exclude your private and other used networks via crypt.def and no vpn traffic rules.")
We need to do similar but are not in a position to upgrade as yet.
