Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Explorer

VPN over VPN

Hi!

How can I do vpn tunnel inside another vpn tunnel (check point)?

0 Kudos
Reply
3 Replies
Champion
Champion

Between which peers do you want the VPN ? The CP VPN is created between two GWs and - apart from FW rules - transparent, so a client/server behind one GW can connect using VPN to a client/server behind the other GW.

0 Kudos
Reply
Explorer

A third-party VPN-client (not CP) is installed on the employee's PC. Also, a third-party VPN-client is installed on an employee’s PC at another office. It is necessary that third-party VPN traffic passes inside the CP VPN tunnel, created between two CP GWs (VPN inside VPN)

0 Kudos
Reply
Contributor

Scheme like this:

(user, want to OpenVPN server)-----"openVPN secured traffic"---->(CP GW)------"openVPN secured trafic encapsulated to IPSec"--------------------->(CP GW)------"decapsulated from IPSec openVPN secured traffic"----->(OpenVPN server)

If you control transport, for some reasons you may incapsulate "openVPN secured trafic encapsulated to IPSec" into GRE tunnel between transport routers (such as cisco). So you can have vpn-in-vpn-in-vpn. OpenVPN traffic inside CheckPoint's VPN and CheckPoint's VPN inside GRE tunnel. Also you may create IPSec vpn between CP and 3rd party hardware. You should show your "path" of traffic for better understanding situation.

For this minimal scheme, you must add user and server in vpn encryption domain on CP sides, add both CP into same VPN community. CP will create VPN between they and encrypt "openVPN traffic" between user and server

0 Kudos
Reply