VPN Multiple interface interoperability device

[Bac26]

Hi

I would like set up vpn  via an interface (not external we use for others vpn) to vpn community where i have an interoperability device.

How do i send the traffic go out on that interface (all the parameter are for locally managed)? the peer is direct attached on that interface so he know the route to the peer but traffic seems not going to that path. Even other peer on that interface we would like setup  vpns and gateway has the route to the peer.

Thank you

[the_rock]

If you attach simple diagram, it would help us guide you.

[PhoneBoy]

If you want to terminate VPNs on different interfaces, you need to adjust the Link Selection settings on the gateway object to determine the IP based on the routing table.

[Bac26]

Yes but then vpn on external interface won't work anymore

[PhoneBoy]

It should if you’ve configured it correctly (both Link Selection and the routing)
In any case, a network diagram would be exceptionally helpful.

[Bac26]

You mean if set link selection on interface towards internal net when terminate my vpn for intranet the vpn using external interface main address facing internet still still work? I have already VPN facing internet interface .5 and would like to set up vpns to my interoperability device via interface 192.168.1.1. static route to 192.168.2.1 is set.

[PhoneBoy]

You set the link selection to be based on routing (instead of a fixed value or interface).
See: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SitetoSiteVPN_AdminGuide/Top...

[Bac26]

sorry what do you mean exactly? can you share a screenshot?

[the_rock]

From the doc @PhoneBoy gave you. By the way, if you look in demo dashboard, you can see same settings.

Andy

You configure the settings in SmartConsole

1. From the left navigation panel, click Gateways & Servers.

2. Double-click the Security Gateway object.

3. Click IPsec VPN > Link Selection.

Remote peers can connect to the local Security Gateway with one of these settings:

• Always use this IP Address

• Calculate IP based on network topology

• Using DNS resolving

• Using probing - Link redundancy mode

[Bac26]

Yes is what I did and choose:

• Calculate IP based on network topology

But this parameters is not for locally managed?

[PhoneBoy]

Assuming you mean a locally managed SMB appliance, there is a similar setting there:

[Bac26]

I mean the parameters you told me to set is related to: Remote peers can connect to the local Security. But I need traffic from central gateway to intranet peers go through that interface

[Gomboragchaa]

I assuming that you cannot use 2 interface for 2 vpn with interoperability device. I had a same issue a long time ago and CP cannot use 2 vpn interfaces with 3rd party gateways. I am not sure the latest gaia can fully support DPD.

If the remote peers are CheckPoint you can accomplish to use multiple interface for vpn that "Calculate IP based on network topology" options. 

I would suggest you contact with TAC and get some enquiry. 

[Bac26]

so if set link selection that interface to intranet, internet vpn wont work right?