- Products
- Learn
- Local User Groups
- Partners
-
More
Celebrate the New Year
With CheckMates!
Value of Security
Vendor Self-Awareness
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
Mobile Security
Buyer's Guide Out Now
Important! R80 and R80.10
End Of Support around the corner (May 2021)
Hi Mates
Just to give more information about the issue I am facing with a customer network.
We are migrating the infrastructure from Cisco ASA to Check Point Firewall, everything seems to be working fine but we have this problem that I need help on how I can achieve the same cenario using Check Point. We are using R80.20
There is sit-to-site VPN between the Cisco Router and Check Point. the machines on Networks C and D must communicate with the machines in Networks A and B (vice-versa) using this site-to-site VPN between Check Point and Cisco Router. In addition to that, Networks C and D must also go to the internet through the site-to-site VPN with Check Point that is connected to the internet.
The site-to-site VPN tunel is closed using the Ips: X.X.X.1 from the Firewall and the Peer is X.X.X.2, in order to allow communication between the Networks A and B and Networks C and D, I am doing NAT on the Firewall. Hence, if a host on network A is trying to connect to the Host on network C, the IP of the host in the network A is NATted to the Firewalls IP (X.X.X.1) and vice-versa.
So we have this cenario:
Problem
Your help will be appreciated
Thanks in advance
Hi Di,
Regarding your questions:
1. Have you verified the crypto map on Cisco's side? Also the inspection parameters for encrypted traffic?
2. I suppose you're using Domain based VPN, where only the shared networks would bring up the tunnel. You should use an universal tunnel (a tunnel for each pair of Gateways with Internet routing defined on Community) with proper ACL on Cisco's side (https://community.cisco.com/t5/vpn-and-anyconnect/default-route-inside-site-to-site-vpn-tunnel/td-p/...) or switch to Route based VPN instead; both options in order to allow required internet access for networks C and D. NAT also plays an important role, all rules probably must be set manually on Check Point GW.
3. As long you have a route through the right interface, you can create VPN tunnels on point to point links without issues. You can use the Link Selection's option "Calculate IP based on network topology". Obviously all your peers should point to the Check Point gateway instead Cisco router.
Hi Kenny
1. Have you verified the crypto map on Cisco's side? Also the inspection parameters for encrypted traffic?
On Cisco S«side the crypto map we have only the Network C and D subnets. And on Check Point I have "All IP addresses behind the clusyter....."
Where can I check the inspection parameters for encrypted traffic?
2. I suppose you're using Domain based VPN, where only the shared networks would bring up the tunnel. You should use an universal tunnel (a tunnel for each pair of Gateways with Internet routing defined on Community) with proper ACL on Cisco's side (https://community.cisco.com/t5/vpn-and-anyconnect/default-route-inside-site-to-site-vpn-tunnel/td-p/...) or switch to Route based VPN instead; both options in order to allow required internet access for networks C and D. NAT also plays an important role, all rules probably must be set manually on Check Point GW.
Yes I am using Domain based VPN. I am thinking about switching to Route based VPN, any special recommendations about route-based VPN.
3. As long you have a route through the right interface, you can create VPN tunnels on point to point links without issues. You can use the Link Selection's option "Calculate IP based on network topology". Obviously all your peers should point to the Check Point gateway instead Cisco router.
So in this case create VPN tunnels using route based VPN right?
Thank you
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY