Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
CheckPointerXL
Advisor
Advisor
Jump to solution

VXLAN over IPSEC configuration

Hi all,

anyone has experience/quick guide with implementation of VXLAN over IPSEC?

I'm trying to set it up with a Fortinet firewall and no success.

 

Tried to follow this guide https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... + VPN with empty group.

I correctly see phase 1 UP and phase 2 UP with same subnet for MyTS and PeerTS, so the IPSEC part seems to be ok.

 

Thank you

 
0 Kudos
1 Solution

Accepted Solutions
CheckPointerXL
Advisor
Advisor

Hey Guys,

thank you for your feedback.

I just solved, the missing key point was related to VTI; once created on fortinet side (https://community.fortinet.com/t5/FortiGate/Technical-Tip-VXLAN-over-IPsec-for-multiple-VLANs-using-...I created it also on Check Point side and VXLAN started to work properly.

It is important to remember:

- allow traffic from peer's VTI to the Check Point GW on port 4789.

- Add to the bridge the VXLAN interface and a VLAN interface, not a normal interface (eth1.10 is good, eth1 is not)

- configure L3 for that VLAN on a port outside the bridge.

 

Hope to help someone in the future 🙂

View solution in original post

5 Replies
PhoneBoy
Admin
Admin

Did you attempt to troubleshoot the VXLAN portion of this?
The SK you linked should provide some troubleshooting steps.
You might also check with fw monitor/tcpdump to see if the traffic is appearing on the correct interfaces.

0 Kudos
dphonovation
Collaborator

I did VxLan with OPNSense across IPSEC. Did you look for UDP/4789 packets traversing the IPSEC tunnel?

CheckPointerXL
Advisor
Advisor

Hey Guys,

thank you for your feedback.

I just solved, the missing key point was related to VTI; once created on fortinet side (https://community.fortinet.com/t5/FortiGate/Technical-Tip-VXLAN-over-IPsec-for-multiple-VLANs-using-...I created it also on Check Point side and VXLAN started to work properly.

It is important to remember:

- allow traffic from peer's VTI to the Check Point GW on port 4789.

- Add to the bridge the VXLAN interface and a VLAN interface, not a normal interface (eth1.10 is good, eth1 is not)

- configure L3 for that VLAN on a port outside the bridge.

 

Hope to help someone in the future 🙂

uwillems
Explorer

Hi did you configured a Layer 2 VXLAN or a Layer 3 VXLAN tunnel?

I have configured a Layer 2 VXLAN tunnel which is working but I want to encrypt it using IPSEC.

I stuck and don't know what to do? Can you give me some insight, thx.

0 Kudos
CheckPointerXL
Advisor
Advisor

Hey

VXLAN is a technolgy to allow layer 2 connectivity thanks to layer3, so i cannot understand your first question

Anyway, follow this sk https://support.checkpoint.com/results/sk/sk170014 and what i wrote in the old post

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events