Help Needed: Site-to-Site VPN Setup (Checkpoint 3600 & Fritzbox Home Router)

[LM-Rafael]

Hi,

I want to connect a headquarters with a branch office using a site-to-site VPN.

Environment Details

Headquarters:

• Device: Check Point 3600 running Gaia R81 (latest updates)
• WAN: Two ISPs (WAN1 & WAN2) with static IPs, connected via VDSL dial-up modem
• LAN: 192.168.88.0/24

Branch Office:

• Device: Fritzbox (latest firmware) acting as the VPN server
• WAN: Static IP
• LAN: 192.168.89.0/24

Configuration Steps Taken

For the Check Point firewall, I followed:

• (2110) Day-14 | IPSec VPN Configuration between Checkpoint and Fortigate Firewall - YouTube

For the Fritzbox setup, I used:

• IPsec Site-to-Site VPN zwischen Sophos XG und Fritzbox konfigurieren - Orange-Fox
• Fritzbox supported Vendor information about IPSEC VPN: FRITZ!Box mit einem Firmen-VPN (IPSec) verbinden | FRITZ!Box 7590

Issue Description

The VPN tunnel sometimes establishes successfully but only after 15–25 minutes. However, traffic is not being routed through the VPN tunnel.

I am unsure why the connection is unstable and why traffic is not passing through.

Request for Help

• How can I ensure traffic is correctly routed through the VPN tunnel?
• Are there specific settings I need to check on the Check Point firewall or the Fritzbox?

Thanks in advance for your support!

Best regards,
Rafael

[the_rock]

Hey Rafael,

We definitely need more info. Where does it fail? Phase 1 or 2? Any logs/debug messages? Route or domain based tunnel? Permanent or not?

To do debug on CP side, just run below:

vpn debug trunc

vpn debug ikeon

-try initiate traffic when its fialing

vpn debug ikeoff

Get iked and vpnd* from $FWDIR/log dir

HTH

Andy

[LM-Rafael]

Hi,

how can i export the files from shell?

Thanks

Rafael

[the_rock]

Most people just enable bin bash shell to do so. You can run chsh -s /bin/bash admin or whatever admin name is. If you wish to return to regular shell, just run same command but instead of /bin/bash, type /etc/cli.sh

Then, you can use winscp to navigate through the directories. Just type cd $FWDIR/log and then pwd to see it in "readable" format.

You can also change all this through web UI page under users.

Andy

[LM-Rafael]

Hi Rock,

here are the files.

Thanks

Rafael

[the_rock]

I will review. What is the peer IP? If you cant say it here, just message me directly.

Andy

[the_rock]

Here is all I keep seeing, but does not tell me much sadly. Where does it fail on CP? Phase 1 or 2? 

Andy

RLL_Sync_ReSchedule: Failed to retieve interval value from parameter

[LM-Rafael]

Hi Andy,

Have you more information for me that how can i extract the information?

Thanks

Rafael

[the_rock]

Sadly, not much more apart from what I sent.

Andy

[the_rock]

Btw, though its long weekend here in Canada where I live, so Monday we have off, but happy to do remote if you are okay with it. Not sure where you are, but Im in EST, which is GMT -5.

Let me know. I think once I can see the config, it would be much easier to try figure this out.

Andy

[LM-Rafael]

Hi Andy,

I would be happy to suggest something. I'm happy to follow your lead. I am from GMT+1 Germany.

Thanks

Rafael

[the_rock]

If you are free say 6 pm your time, I can send link for the remote then, let me know.

Andy

[LM-Rafael]

Hi Andy,

Sorry, I just saw your message now. I’m available at 8 PM. Does that work for you? Which platform would you prefer for our discussion? Teams, TeamViewer, or something else?

Thanks

Rafael

[the_rock]

Usually, for these things, I use my personal zoom if you dont mind. Our corporate is teams, but my zoom, since its just via my gmail, its good for 40 mins free and then you need to wait 10 mins to have another 40 mins remote and so on, but Im sure 40 mins is more than enough 🙂

If 8p, is good for you, thats 11 more mins, let me have quick lunch and I will send you the link directly.

Best,

Andy

[LM-Rafael]

Yeah 8 pm is perfect. rafael@lema-it.de.

[the_rock]

Just sent it.

[LM-Rafael]

Hi Andy,

i get the message: Meeting ID is wrong.

Thanks

Rafael

[the_rock]

Just sent you correct one, sorry.

[the_rock]

First link did not work, try this:

https://us04web.zoom.us/j/76342977538?pwd=0g1cbeFsTPpCod2MSb2izxHIcK4BQz.1

[the_rock]

If you are around, let me know, Im free for remote.

Andy

[Chris_Atkinson]

Be aware that R81 is EOL as at October 2024 so upgrading to e.g. R81.20 is recommended to engage support etc.

[the_rock]

Good point Chris.

[LM-Rafael]

Hi Chris,

R81.20 Jumbo Hotfix Take 92 is installed.

Thanks

Rafael

[the_rock]

Hi everyone,

Just had remote with Rafael. Based on the debug, Im 100% positive it has to be something with the enc. settings thats mismatched. @LM-Rafael , I just opened the link I found for Frotzbox, can you ensure phase 1 on CP side is showing DH group 2, since I dont believe it works with DH group 14.

For phase 2, you can also use group 2, but then PFS needs to be on.

Andy

RS details:

-remote with Rafeal

tunnel is down at the moment

verified config file from the Fritzbox device, seems correct

phase 1 and phase 2 settings from Fritzbox config file

sharing is per subnet only

enc settings aes256 sha 512 and DH group 14

verified the rule as well, both subnets in src/dst and correct community under vpn column -> accept

installed the policy

checked tunnel status

on Fritz box, we just see status of the tunnel as unknown

checked CP side via vpn tunnel

ran debug on cp side -> fw ctl zdebug + drop | grep peer_IP

debug -> clear text packet should be encrypted

dpd is disabled on peer side, so we also disabled on cp side, along with nat within vpn community

disabled pfs, since its not supported on Fritzbox end

tested again -> same issue

Rafael will confirm phase 1 and 2 settings on Fritzbox side

[LM-Rafael]

Hi Andy,

Thanks for your support. I have researched the issue, and now the tunnel is up again, but no traffic is routing through it.

Issues I have found and fixed:

• ICMP to the WAN IP was not allowed → FritzBox log showed a timeout → This is now fixed.
• Backup and primary WAN → Set the default gateway to the VPN WAN → OK.

However, I don't understand why the tunnel is up, but no traffic is going through it.

Here is the output of the command: vpn tu

[Expert@LMENFW01:0]# vpn tu

********** Select Option **********

(1) List all IKE SAs
(2) * List all IPsec SAs
(3) List all IKE SAs for a given peer (GW) or user (Client)
(4) * List all IPsec SAs for a given peer (GW) or user (Client)
(5) Delete all IPsec SAs for a given peer (GW)
(6) Delete all IPsec SAs for a given User (Client)
(7) Delete all IPsec+IKE SAs for a given peer (GW)
(8) Delete all IPsec+IKE SAs for a given User (Client)
(9) Delete all IPsec SAs for ALL peers and users
(0) Delete all IPsec+IKE SAs for ALL peers and users

* To list data for a specific CoreXL instance, append "-i <instance number>" to your selection.

(Q) Quit

*******************************************

1

Peer 212.117.93.31 , Office_VPN_GW SAs:

IKE SA <66551d2d7a4f33fd,b76ce610f7d24c5f>

IKE SA <919933155d887ea6,f74a584a613eace3>

Hit <Enter> key to continue ...

********** Select Option **********

(1) List all IKE SAs
(2) * List all IPsec SAs
(3) List all IKE SAs for a given peer (GW) or user (Client)
(4) * List all IPsec SAs for a given peer (GW) or user (Client)
(5) Delete all IPsec SAs for a given peer (GW)
(6) Delete all IPsec SAs for a given User (Client)
(7) Delete all IPsec+IKE SAs for a given peer (GW)
(8) Delete all IPsec+IKE SAs for a given User (Client)
(9) Delete all IPsec SAs for ALL peers and users
(0) Delete all IPsec+IKE SAs for ALL peers and users

* To list data for a specific CoreXL instance, append "-i <instance number>" to your selection.

(Q) Quit

*******************************************

2

SAs of all instances:

Peer 212.117.93.31 , Office_VPN_GW SAs:

IKE SA <66551d2d7a4f33fd,b76ce610f7d24c5f>
INBOUND:
1. 0xc2c3f2ef (i: 2)
OUTBOUND:
1. 0x952272db (i: 2)

IKE SA <919933155d887ea6,f74a584a613eace3>
INBOUND:
1. 0xbe531669 (i: 2)
OUTBOUND:

Any ideas?

Thanks

Rafael

[the_rock]

Just try initiate traffic and run that zdebug command grepping for the relevant IP, same like what we did on zoom remote. So say you are trying to access 192.168.2.5 from CP side, initiate ping or whatever protocol/port and then in ssh window, run fw ctl zdebug + drop | grep 192.168.2.5 or whatever the right IP is.

Also, check if any relevant logs in smart console to see why its failing.

GREAT job getting tunnel up.

Andy

[LM-Rafael]

Hi Andy,

i try with a ping and i get no output and only the message "Destination Network not reachable"

C:\Users\rafael>ping 172.16.22.1

Ping wird ausgeführt für 172.16.22.1 mit 32 Bytes Daten:
Antwort von 87.234.14.57: Zielnetz nicht erreichbar.
Antwort von 87.234.14.57: Zielnetz nicht erreichbar.
Antwort von 87.234.14.57: Zielnetz nicht erreichbar.
Antwort von 87.234.14.57: Zielnetz nicht erreichbar.

Ping-Statistik für 172.16.22.1:
Pakete: Gesendet = 4, Empfangen = 4, Verloren = 0
(0% Verlust),

C:\Users\rafael>

This IP is also unknown for me: 87.234.14.57

And 

[Expert@LMENFW01:0]# fw ctl zdebug + drop | grep 172.16.22.1

gives 0 Output

Thanks

Rafael

[the_rock]

Can you try similar on Frotzbox side?

Andy

[LM-Rafael · Accepted solution]

Hi Andy,

After fixing the WAN 1 and WAN 2 roles (Primary and Backup) and deleting my policy-based routing rule, everything is running fine.

Thanks for your Support

Rafael

[the_rock]

Amazing job @LM-Rafael !

Andy