Site-To-Site connectivity and application access

[BSBhatia]

Hi

After migration to checkpoint firewall 5900 (R80.10) at two geographically separated sites, network access from one site to another does not work, when the tunnel terminating on the edge routers of the two sites is in place. But as soon as the tunnel is removed between the two edge routers network access is enabled and applications across the sites become accessible.

Kindly help to fix the issue.

Thanks

BS Bhatia

[Nick_Doropoulos]

Hi Bhatia,

Would you mind sharing with us a basic diagram of your topology?

Many thanks.

Nicholas

[BSBhatia]

The topology diagram is attached as file "Diagram.docx".

[PhoneBoy · Accepted solution]

If I'm understanding this correctly, you have routers between the two Check Point gateways doing an IPSec tunnel between the two sites, correct?
Generally, that's going to cause MTU issues.
What I suspect is happening is the following:

• Large packet comes through Gateway A with the Don't Fragment Bit set
• When that large packet hits the router and it tries to go through the IPsec tunnel, the packet + IPsec header will be larger than the MTU
• The router is sending back an ICMP message back saying "Fragmentation Needed" which is getting dropped at the firewall

The end result is traffic doesn't work.
You can easily confirm all of the above with tcpdump or similar.

The solution is pretty simple: configure the access policy to allow ICMP Fragmentation Needed packets from the router.

[BSBhatia]

Thanks a lot for the solution.

After reducing the MTU on firewall interface connected to the edge router at both the ends (to 1320), network access across the sites is working fine.