VPN between on-premise cluster and Azure using VTI

[khodgson_bts]

Evening all. I'm hopeful that someone can help me with this.

In the past I have successfully managed to set up a route-based VPN between a physical Check Point cluster and an AWS VPC by following the steps in sk100726, no problems there at all. Now I'm looking to configure something similar to an Azure Virtual Gateway using VTIs, but I'm struggling to find any reference documentation or process like the AWS one.

I've been playing around with it all day and I can't see a way to make it work, and I'm starting to wonder if it even is possible at all. I've looked at sk101275 but I don't think it really applies to what I'm trying to achieve.

Has anyone successfully done this, and if so, how? What other options are there for creating an IPSEC VPN to Azure with a primary/backup configuration? BGP is not really an option in this scenario.

Thanks.

[Alex-]

The Azure VWAN guide is very good, we used it for route-based VPN to Azure VPN gateways and it worked straight away.

[khodgson_bts]

That seems to require BGP to work though. Have you done it without BGP? What IP's do you assign to the VTI's?

[the_rock · Accepted solution]

See if below posts I made and responded to help. If not, message me, I have done this few times.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Route-based-VPN-tunnel-to-Azure/m-p/206179/emc...

https://community.checkpoint.com/t5/Security-Gateways/Route-based-VPN-failover-issue/m-p/155553#M265...

[khodgson_bts]

That looks very promising, thank you. I'll give it go.

[the_rock]

Sounds good!

[the_rock]

By the way, since you mentioned BGP, I always found the ONLY way to make BGP work through the route based tunnel is to use UNNUMBERED VTIs, meaning it will "piggyback off" the main interface and when you configure it, it will have exact same IP in topology, but nothing to be alarmed about, its 100% normal.

Andy

[khodgson_bts]

That's good to know. In this case I'm specifically looking to not use BGP. I'll let you know how I get on.

[the_rock]

I attached doc file with 3 screenshots I took, hope that also helps. Anyway, message me directly if you are not clear and we can do remote.

Andy

[khodgson_bts]

This was very useful; I've managed to get it working. It's really not that different from the AWS process.

Thank you!

[the_rock]

Of course, glad we can help. Yes, for regular route based, you can use either numbered or unnumbered, but I find using unnumbered is better, as you simply use vti to route the traffic when you create new routes and no need to be setting up new IPs. But again, works either way 🙂

Glad you got it going.

Andy