Site-2-Site VPN with Cisco Cloud (Cisco Secure Acccess)

[Michael_Menen]

Hi all,

We want to set up a site-to-site VPN connection between the Check Point cluster and the Cisco Secure Access Cloud.  
Unfortunately, on the Cisco platform, you must specify either one remote email identifier or two remote public IP addresses.
At the Check Point, I only have one public IP available for the tunnel, the public cluster IP. 
Unfortunately, route-based VPN is not an option either, as Check Point only provides one public IP address, but Cisco Cloud requires two.
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SitetoSiteVPN_AdminGuide/Topics-VP...


Best regards.
Michael

[the_rock]

Hey Michael,

I am not familiar with that side of Cisco, but I fnd it very odd it would require 2 IP addresses. Do you have any document stating that or screenshot you can attach from their end?

[Michael_Menen]

Good morning Andy,

Attached is the documentation from Cisco.
The issue is the Tunnel-ID.
Cisco requires either an EMail-Address or a primary and secondary IP-Address

 

Best regards.
Michael 

 

[the_rock]

Wait a second. To me, logically, though I could be mistaken, it would imply they are referring to REDUNDANT tunnels, not if its just a single one. Can you please verify that with them?

[Michael_Menen]

Yes, seems that Cisco wants to establish a second redundant tunnel but to a different public IP and there's no way around.

I tried to configure a route-based-VPN-Tunnel like described in sk100726 (Site-2-Site-VPN with AWS) but was informed, that on Cisco site a secondary remote public IP is needed.
I had a remote session with the VPN-partner and there's no way to bypass this bloody second public remote IP-Address.

[the_rock]

But, if you are able to talk to someone in Cisco support, can you verify this with them? It absolutely makes no logical sense this would be needed for single tunnel.

[CKing]

@Michael_Menen 
We're looking at setting up a connection to Cisco Secure Access in the near future and we're just wondering if you did get any feedback from support whether they are likely to change this requirement of Primary/Secondary tunnels.

Thinking we'll have to use a second public IP on the Check Point side just to satisfy Cisco

[PhoneBoy · Accepted solution]

You can configure the gateway to use an email address as the Tunnel ID: https://support.checkpoint.com/results/sk/sk182890 

[the_rock]

Interesting, never knew that was possible.

[PhoneBoy]

I didn't either until I searched SK. 🙂

[the_rock]

I have a hard time believing one of biggest geniuses I know, aka Phoneboy, did not know that...just saying 🙂

[PhoneBoy]

If I never ran across it before...how would I know it? 😜

[Michael_Menen]

Thank you very much for the SK.

As far as i understand the sk certificate authentication is required between the VPN gateways.
I'm not sure if the Cisco Secure Access Cloud is supporting certicicate authentication for VPNs. 
Additional to that I have to renew the IPsec VPN certificate on the Check Point gateways and reboot the firewalls.
After that the "Certificate Subject Alternative Name" will be provided in any VPN-Tunnel (for than 30 are configured at the moment).
Ufffff......not sure if the customer will like that.

I will get in cpontact with the customer and Cisco.
Thanks!  

[the_rock]

Maybe not optimal, but given the circumstances, most likely best option.

[PhoneBoy]

Unless they're all in the same mesh VPN community, you don't have to change all the other VPNs to certificate-based auth.

[71mb00]

Hi Michael, did you get this working? did the email address as the Tunnel ID thing work ?