VPN Domain and VPN VTI

[Marquevis]

Hello,

I have a customer with several locally managed SMB gateways. Each SMB gateway has at least 03 VPN DOMAIN. The need arose to configure some VTI VPN. In the documentation, VTI VPN requires that the tunnel is per gateway pair. In the SMB gateway settings I  only find this setting globally. I cannot change this configuration globally, because VPN DOMAIN will be unavailable. I need to find a way to configure VPN DOMAIN and VPN VTI on the SMB gateway, without changing this configuration globally.

[the_rock]

Let me spin up quick smb spark demo and see.

Andy

[the_rock]

Hey, not sure what was the setting you were referring to, but is it possible its below?

Andy

[Marquevis]

Hello the_rock.

The configuration I'm referring to is the one below.

One of the requirements for configuring VTI is that we use gateway pair configuration.

[the_rock]

My apologies, I cant seem to find that in demo I spun up, but will check again. So you are saying thats global option?

Andy

[Marquevis]

Yes, it is a global configuration.

I need to find a way to do this configuration on each VPN site. Some VPNs will have a subnet pair and others will have a gateway pair.

[the_rock]

So sorry I dont have access to real smb device to test : - (. Is there any setting on specific vpn tunnel that would let you change it or this is the only place?

Andy

[Marquevis]

This is exactly what I'm looking for. It seems to me that there is only this global configuration.

[the_rock]

Got it. Are you allowed to do remote? I really want to try and help with this, because I have a gut feeling might be possible.

Andy

[Marquevis]

Unfortunately, our internal policy does not allow this.

[the_rock]

Understood. So, if you edit any given vpn tunnel, you dont see option to change this individually at all?

Andy

[Marquevis]

Correct, I don't see any option to change this individually.

If this option exists, it must be within some configuration file in the shell.

[the_rock]

Maybe SMB master @G_W_Albrecht might know? Otherwise, I would recommend asking TAC via official case. I will keep checking in the meantime, just bit tricky with demo, as I cant seem to get RDP to open in full screen.

Andy

[the_rock]

I just created bogus tunnel and sadly, cant see option anywhere in the settings similar to below in smart console community.

Andy

[Marquevis]

The checkpoint instructed me to configure the unnumbered VTI.

https://support.checkpoint.com/results/sk/sk121740

[the_rock]

Thats fine, but not sure if that really addresses your issue specifically?

Andy

[the_rock]

Though, now that I read that sk again @Marquevis , appears it should help, since its related to individual vpn tunnel.

Andy