Tuesday, May 24, 2011

Creating a Certificate Based Site to Site VPN between 2 Check Points Gateways

Site A

Create VPN Community

Within your Gateway Object add you local domain to "Topology | VPN Domain | Manually Defined"
Within Network Objects create a Externally Managed VPN gateway (For Site B) and add its local domain.
Goto the VPN communities Tab and Right Click "Site To Site" and select "New" then "Mesh".
Give your Communitiy a name
Select "Accept all encypted traffic"
Within Participates add your Gateways.
Click Ok.
Export the Certificate

Within the Servers and OPSEC applications tab right click "Servers > Trusted CAs > Internal CA" and select "New > CA > Trusted > New CA > Trusted."
Enter a name for your Certificate (such as VPN-CERT)
Under the Certificate Authority TYpe choose "External Check Point CA"
Click the External Check Point CA tab and select "Save As".
Save the Certificate


Site B

Create VPN Community

Within your Gateway Object add you local domain to "Topology | VPN Domain | Manually Defined".
Within Network Objects create a Externally Managed VPN gateway (For Site A) and add its local domain.
Goto the VPN communities Tab and Right Click "Site To Site" and select "New" then "Mesh".
Give your Communitiy a name
Select "Accept all encypted traffic"
Within Participates add your Gateways.
Click Ok.
Import the Certificate

Within the Servers and OPSEC applications tab right click Servers and select "New > CA > Trusted"
Enter a name such as VPN-CERT.
Under the Certificate Authority TYpe choose "External Check Point CA".
Click the External Check Point CA tab and select "Get".
Import the previously saved certificate from Site A.