VPN Site-to-Site Peer Route All Traffic Through Check Point

[Bernardes]

Dear friends,

could you please help me with the following situation:

I am going to establish a tunnel between Site A (Check Point) and Site B (SonicWall), and I need all traffic, including internet browsing from Site B, to pass through Site A.

What is the best option to achieve this?

How should I configure the VPN Domains at gateways options on Sites A and B?

[PhoneBoy · Accepted solution]

In a "route all traffic" scenario, you have to do one of two things:

• Use Route-Based VPN (where the encryption domains are empty or 0.0.0.0/0), everything is controlled through the routing table.
• In the relevant VPN community, ensure "One Tunnel Per Gateway Pair" is selected, which I believe means we will negotiate a 0.0.0.0/0 SA with the VPN peer:

If using domain-based VPN, on the Check Point side, your encryption domain would include the hosts behind it and you define the remote encryption domain as the hosts behind the remote gateway.
Can't speak to the Sonicwall side of the configuration in either case. 

[Blason_R]

This is absolutely correct and you must go with route based VPN.