Why is my BGP (TCP 179) traffic getting blocked by Check Point when set up vpn to AWS

[vanhieuptit4]

Hi all,

I’ve successfully established a VTI-based VPN tunnel between my Check Point firewall and AWS. Phase1 up, phase2 down beacause  rule block for connect ip 169.254.x.11 (AWS point) --> 169.254.x.10 (Onprem point) service bgp tcp/179. I’m seeing logs that say:

"According to the policy the packet should not have been decrypted" 

I have already:

• Set VPN domains to 0.0.0.0/0 (Empty Group) on both ends.

• Enabled "VPN Directional Match in VPN Column" and configured the VPN column accordingly. "Choose "Add" to add directional match rules as follows:
  a. internal_clear --> vpn-02f8b875e8179c57b
  b. vpn-02f8b875e8179c57b --> vpn-02f8b875e8179c57b
  c. vpn-02f8b875e8179c57b --> internal_clear"

• Created rules to allow communication between AWS and on-prem subnets.

Still, the traffic for BGP (port 179) seems to get blocked — and the log shows it's being dropped on the external interface (eth0), not on the VTI interface (vpnt1). I suspect the stealth rule might be affecting this traffic.

Thanks in advance for any help!

[_Val_]

According to your VPN settings, all traffic between the GWs should be encrypted, yet BGP is sent in clear text. You may want to tackle this by excluding BGP form the VPN and reinstalling policy

[vanhieuptit4]

Hi,

Thanks for the suggestions. I’ve followed the recommendation to exclude BGP (TCP 179) from the VPN community and reinstalled policy, but I still see the same log:

"According to the policy the packet should not have been decrypted"

The traffic is still being dropped,

I added TCP 179 (BGP) under “Excluded Services” in the VPN community and pushed policy.

I allowd bgp in policy rule.

I see traffic BGP going out interface vpnt1, but traffic arrive to interface eth0, 

[the_rock]

K, one sec...now that I think about it, seems as if BGP range should be in vpn domain, since it should be encrypted, according to the message. 

Technically, CP domain does not need to be empty group, only AWS one.

Maybe change that and test.

Andy

[the_rock]

Apart from great point @_Val_  made, which tells you that packet should have been encrypted, you can also try zdebug and see if same failure occurs.

Andy

[the_rock]

Also, if you think stealth rule might be the culprit, just try disable it temporarily and test. FWIW, I always found BGP works way better when using unnumbered VTIs.

Andy

[emmap · Accepted solution]

I believe 'should not have been decrypted' means that it came in encrypted, the gateway decrypted it to see what was inside, then thinks 'hey this should have been sent in the clear'. BGP in this case should be encrypted, so don't exclude it from the tunnel.

Have you checked this: https://support.checkpoint.com/results/sk/sk106627

[the_rock]

That was my thinking as well.

[vanhieuptit4]

Yes, It's work when set vpnt1 to peer name

Thanks for solution

[the_rock]

I assumed you had that already. Glad you got it now!