Site to Site VPN with DAIP Gateway and NAT hide not working

[bbruelhart]

When trying to connect a DAIP VPN Gateway with NAT hide to the VPN VSX, no VPN tunnel can be established. In the files iked.elg and vpnd.elg I don't find a reason why this VPN tunnel cannot be established.

The Check Point TAC told us that this is not working due to the fact that NAT hide changes the source port IKE from 500/udp to a high port and also NAT-T from 4500/4500 to a high port. Still the destination port remains correct.

All other site to site VPN tunnels work fine. They all have a fix public IP address. Please help me to find the reason why this is not working.

Does anybody have experience with such a topology or even a setup which is working?

Thank you for your help.

[the_rock]

Would you mind send debug files? Happy to review myself (you can also DM me, no problem). By the way, in my humble opinion, if dst port is unchanged, then you are fine, because source port literally would never matter, only destination one.

Andy

[bbruelhart]

Hello Andy

Thanks for your fast answer. That's what I thought as well that the source port would not matter but the engineers in the case insisted that it has to have the same source port for IKE and NAT-T. 
I will try to find the requested files and send them to you.

On the central side I have a cluster of Quantum 26000 with a VSX for VPN connection and on the remote side I have a Quantum Spark 1575. 

Should that topology work at all?

[the_rock]

That should be fine. Is it star community? Honestly, I still have hard time with understanding how same source port would need to be the same, but maybe someone else can confirm for sure.

Andy

[_Val_]

Why do you use S2S for a DIAP GW? The reasonable choice would be to fall back to RAS VPN in this case. Did you try that?

[bbruelhart]

Hello 
Now, I am confused. How would I define a RAS VPN then?
What object would I define in the SmartConsole for die DIAP gateway?

Regards

Beat

[G_W_Albrecht]

Should work if the DAIP GW starts the VPN tunnel. DId read this sk167473: Dynamically Assigned IP Address (DAIP) Gateway FAQ?

[bbruelhart · Accepted solution]

I was able to configure both, the dynamic gateway and the center side VSX, both on the same management server.

After allowing the ports FW1_ica_pull, FW1_ica_push, FW1_ica_services and FW1_log and defining the dynamic gateway's MAC address I was able to configure the SIC securely.

After that I could pull the prepared policy from the management server and then the VPN tunnel and the prepared policy was working.

Thanks again to Andy, the legend, for his support.

[G_W_Albrecht]

Why did you have to allow these ports ? Are they not covered by implied rules ?

[bbruelhart]

The DIAP gateway is in the Internet and needs to communicate with the Check Point management server which is behind the Internet firewall. So, for the SIC I allowed FW1_ica_service, FW1_ica_pull, FW1_ica_push, FW1_log and CPD to th public (NAT) object of the managment server. Only with the implied rules this did not work for me.
Is there another way to do that? 

[G_W_Albrecht]

I can not verify that - this had not been a need for non-VSX GAiA GWs / SMS with older SMBs. But as it is working that seems the correct way to do it 😉