VPN over VPN

[Artyom_Nikulin]

Hi!

How can I do vpn tunnel inside another vpn tunnel (check point)?

[G_W_Albrecht]

Between which peers do you want the VPN ? The CP VPN is created between two GWs and - apart from FW rules - transparent, so a client/server behind one GW can connect using VPN to a client/server behind the other GW.

[Artyom_Nikulin]

A third-party VPN-client (not CP) is installed on the employee's PC. Also, a third-party VPN-client is installed on an employee’s PC at another office. It is necessary that third-party VPN traffic passes inside the CP VPN tunnel, created between two CP GWs (VPN inside VPN)

[AlexeyB]

Scheme like this:

(user, want to OpenVPN server)-----"openVPN secured traffic"---->(CP GW)------"openVPN secured trafic encapsulated to IPSec"--------------------->(CP GW)------"decapsulated from IPSec openVPN secured traffic"----->(OpenVPN server)

If you control transport, for some reasons you may incapsulate "openVPN secured trafic encapsulated to IPSec" into GRE tunnel between transport routers (such as cisco). So you can have vpn-in-vpn-in-vpn. OpenVPN traffic inside CheckPoint's VPN and CheckPoint's VPN inside GRE tunnel. Also you may create IPSec vpn between CP and 3rd party hardware. You should show your "path" of traffic for better understanding situation.

For this minimal scheme, you must add user and server in vpn encryption domain on CP sides, add both CP into same VPN community. CP will create VPN between they and encrypt "openVPN traffic" between user and server