VPN Site-to-Site, Gateway at other site!

[Moudar]

Hi, 

I got this topology:

Where A-GW-1 & A-GW-2 creates a cluster on the central office. 

vIOS router is representing the internet.

B-GW is an embedded 1575 gateway and is a branch office with own external dynamic IP address! I wonder here how to add B-GW to SMS when it has a dynamic IP! I mean when the ISP changes the IP how would it keep connection to SMS?

What is needed is for VPC15 to have its gateway at "switch-center"

Switch-center (central office) has many interface VLANs, the interface VLAN that is needed as a gateway to VPC15 is VLAN10 10.10.10.14

What I read is that 1575 does not support directional VPN enforcement so VTI is not an option! correct me if I am wrong

What I think would work is using NAT in some way, which I don't know!

So, any help is appreciated! 

[the_rock]

Hey, is this related to the post you had the other day, where Emmap mentioned to enable control connections setting on the management server? That did not help?

Andy

[Moudar]

The problem that I had on the other post was that SMS could not get connected to B-GW through the internet. The answer that Emmap gave was correct to activate static NAT under SMS object settings.

The question here is how VPC15 can have its gateway on the other side?

[the_rock]

Can you explain little, sorry? Im not sure what you mean "have its gateway on the other side" and what exactly is it supposed to connect to?

Andy

[Moudar]

If you take a look at the topology, you can see VPC15 which sits behind B-GW. VPC15 needs to have its gateway on the other side, on switch-center. Is it possible to do that? The goal is to have for example three different VLANs behind B-GW which will talk to servers behind the A-GW-Cluster.

[the_rock]

Im still not clear, sorry...what do you mean have its gateway on the other side?

[Moudar]

Assuming VLAN 510 at the central office grants users access to various servers and services, how would users in the branch office (connected through B-GW) reach the same resources (all resources are sitting behind the cluster at the central office) while being located behind the Branch Gateway (B-GW)?

Let's say the branch office needs multiple VLANs beyond just a user VLAN. If we connect a switch to the Branch Gateway (B-GW), and this switch will have 5 separate VLANs, how would the B-GW firewall handle routing traffic from those 5 VLANs to the central office?

Let me know if this clarifies things better.

[the_rock]

I would probably need to see it for myself, but sounds like you need to include all those vlans in enc domain and also enable vpn routing inside the vpn community as per below.

Andy

 

[Moudar]

sounds like "To center or through the center..." is the option needed ! so running OSPF on both sides maybe an option?

Another question about user mode, when trying to change from kernel mode to user mode I see this message:

"Important note: this action might have an effect on GW CoreXL split" 

What effect could that be?

[the_rock]

Kernel mode is limited

https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-User-Mode-Firewall-v...

By the way, for dynamic routing, I would STRONGLY recommend using UNNUMBERED VTIs for vpn tunnel, I did extensive lab testing with this and appears thats best way to make it work. What would happen is you would see new vti pop up in topology and you can assign same VIP as external interface its based off of, dont worry, thats fine, wont give you any issues.

Andy

[Moudar]

VTI, do we need directional VPN configs? 1575 does not support that!?

[the_rock]

Yes, but as far as 1575, I really dont know, literally never work with SMB, sorry : - (

[Moudar]

So VTI is not an option! What other option do we have?

[the_rock]

You can try VTI, but maybe confirm with TAC if its possible on smb.

Something like below.

Andy

tunnel ID is only relevant if 3rd party tunnel, so say if its PAN, ID has to match on both ends

 

[PhoneBoy]

Is the 1575 managed by the same management as A-GW and B-GW?
Are A-GW and B-GW a ClusterXL cluster or are they completely independent?

In any case, the object representing the 1575 needs the Dynamic IP option checked in the General tab.
Note that only CERTIFICATES (not Shared Secret) can be used on VPN that involve DAIP endpoints (this is by design for security reasons).
The DAIP gateway periodically generates traffic so the other end is aware of its IP.

Not clear on what the proposed traffic flows are in this scenario, nor is it clear that you need to use VTIs to achieve your desired ends.
If you're not using VTIs, the networks accessible via the VPN are a function of the local Encryption Domain on the relevant gateways.

[Moudar]

A-GW-1 and A-GW-2 form a cluster, while B-GW represents the branch office.

B-GW will be administered by the same Security Management Server (SMS) responsible for the A-GW cluster. In this scenario, do we still require certificates?

The intention is for B-GW to exclusively function as a VPN device, with all traffic inspection governed by policy rules set on the A-GW cluster.

I am uncertain about the support for Virtual Tunnel Interfaces (VTI) on the 1575 model, especially considering the absence of directional VPN capabilities.

[PhoneBoy]

VPN peers that have DAIP must use certificates, regardless of whether the peer is managed by you or someone else.
Considering all gateways are managed by the same management, this should not be an issue.

With ClusterXL, you cannot have one member do exclusively VPN and the other do traffic enforcement for your internal clients.
They would have to be defined/managed as two separate (not clustered) gateways to achieve this separation.

Directional Match (as described here: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SitetoSiteVPN_AdminGuide/Con... ) is not supported on SMB appliances.
It has nothing to do with VTIs, which are supported on SMB: https://support.checkpoint.com/results/sk/sk178604

[the_rock]

Correct me if Im wrong when I say this, but Im fairly sure this direction match setting is mostly used with route based VPNs? I had never seen it for regular domain based tunnels, at least I cant remember.

Andy