Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Baasanjargal_Ts
Advisor

How to pass Remote peer internet except lan traffic through Checkpoint. ?

Jump to solution

Does it possible to HOST_B access to internet through Checkpoint firewall by using IPSEC vpn tunnel.?

If yes, how to configure this.

 

 

45.png

0 Kudos
Reply
1 Solution

Accepted Solutions
G_W_Albrecht
Champion
Champion

Then we need to consult  Site to Site VPN Administration Guide R80.20 p.72 :

Configuring VPN Routing in Domain Based VPN 

Configure most common VPN routing scenarios through a VPN star community in SmartConsole. 

You can only configure VPN routing between Security Gateways that belong to a VPN community. 

Configuring VPN Routing for Security Gateways in SmartConsole 

To configure a VPN Routing in a star community in SmartConsole: 

1. On the Star Community window, in the: 

a) Center Gateways section, select the Security Gateway that functions as the "Hub". 

b) Satellite Gateways section, select Security Gateways as the "spokes", or satellites. 

2. On the VPN Routing page, Enable VPN routing for satellites section, select one of these options: 

To center and to other Satellites through center - This allows connectivity between the Security Gateways, for example if the spoke Security Gateways have dynamically assigned IP addresses, and the Hub is a Security Gateway with a static IP address. 

• To center, or through the center to other satellites, to internet and other VPN targets - This allows connectivity between the Security Gateways as well as the ability to inspect all communication passing through the Hub to the Internet. 

3. Create an appropriate Access Control Policy rule. Remember: one rule must cover traffic in both directions. 

4. NAT the satellite Security Gateways on the Hub if the Hub is used to route connections from Satellites to the Internet. 

View solution in original post

4 Replies
PhoneBoy
Admin
Admin
You may be able to do it with a Route-based VPN (versus a Domain-based one).
That said, I've never personally tried it.
0 Kudos
Reply
PhoneBoy
Admin
Admin
Except this is a site-to-site VPN link, not Remote Access clients.
0 Kudos
Reply
G_W_Albrecht
Champion
Champion

Then we need to consult  Site to Site VPN Administration Guide R80.20 p.72 :

Configuring VPN Routing in Domain Based VPN 

Configure most common VPN routing scenarios through a VPN star community in SmartConsole. 

You can only configure VPN routing between Security Gateways that belong to a VPN community. 

Configuring VPN Routing for Security Gateways in SmartConsole 

To configure a VPN Routing in a star community in SmartConsole: 

1. On the Star Community window, in the: 

a) Center Gateways section, select the Security Gateway that functions as the "Hub". 

b) Satellite Gateways section, select Security Gateways as the "spokes", or satellites. 

2. On the VPN Routing page, Enable VPN routing for satellites section, select one of these options: 

To center and to other Satellites through center - This allows connectivity between the Security Gateways, for example if the spoke Security Gateways have dynamically assigned IP addresses, and the Hub is a Security Gateway with a static IP address. 

• To center, or through the center to other satellites, to internet and other VPN targets - This allows connectivity between the Security Gateways as well as the ability to inspect all communication passing through the Hub to the Internet. 

3. Create an appropriate Access Control Policy rule. Remember: one rule must cover traffic in both directions. 

4. NAT the satellite Security Gateways on the Hub if the Hub is used to route connections from Satellites to the Internet. 

View solution in original post