Creating a basic Route Based VPN between 2 Check Point Firewalls

Within this example we will build a Route Based VPN between 2 SPLAT R65 NGX Check Point Firewalls. Static Routes will used to direct the traffic via the VPN Tunnel Interfaces.

In this example both Firewalls are managed by the same manager. The gateways are :

Site A - External 192.168.1.1 Inside 10.1.1.1
Site B - External 192.168.2.1 Inside 10.1.2.1
In order to build a route based vpn we need to create VPN Tunnel Interfaces. A VPN Tunnel Interface is a virtual interface on a VPN-1 module, which is associated with an existing VPN tunnel, and is used by IP routing as a point to point interface directly connected to a VPN peer gateway.

Virtual Tunnel Interfaces (VTI's)

VTIs can be created only on SPLAT and IPSO (3.9 or above). Though you can only create numbered VTIs within SPLAT. A numbered tunnel interface has a unique IP address assigned to it, while an unnumbered tunnel interface does not.
In order to create VTI`s you will need to ensure you are running SPLAT Pro. And that the Dynamic Routing feature is enabled. You will also need the nessecary license for this feature.

Steps

Create Object

Create a Group Object called Empty containing no objects within SmartDashboard
Site A

Create the VTI by running the command on Site A's CLI :
1.
vpn shell i a n 22.22.22.1 22.22.22.2 SiteB
Within the Gateway Object under Topology add you Object named Empty as your VPN Domain.
Within the Gateway Object under Topology use the "Get" icon to retrive your new VPN Tunnel Interface (VTI).
Site B

Create the VTI by running the command on Site B's CLI :
1.
vpn shell i a n 22.22.22.2 22.22.22.1 SiteA
Within the Gateway Object under Topology add you Object named Empty as your VPN Domain.
Within the Gateway Object under Topology use the "Get" icon to retrive your new VPN Tunnel Interface (VTI).
General

Create a new Meshed Site-2-Site Community within the VPN Community Tab.
Under General select Accept All Encrypted Traffic
Under Paricitpating Gateways add both Site A and Site B.
Push the Policy to both gateways.
Add Static Routes

On Site A add the following commands via the CLI :
1.
route add -net 10.1.1.0 netmask 255.255.255.0 dev vt-SiteB ; route --save
On Site B add the following commands via the CLI :
view sourceprint?
1.
route add -net 10.1.2.0 netmask 255.255.255.0 dev vt-SiteA ; route --save

SSL VPN on a Check Point Gateway

Create a new network object. This will be used as the remote users IP address. Name this "net_office-mode-IPs"

Within the Check Point Object under Tolopogy > VPN Domain add your local domain.
Within the Check Point Object under Remote Access make the following changes : Enable Support Vistor Mode

Within the Check Point Object under Office Mode - Select "Allow Office Mode to all users". Add this new network object under Manual (Allocate IP address from Network)
Within the Check Point Object Under Client VPN - Tick Support Clientless VPN. Under Certificate for gateway authentication select ICA_CERT.

Within the Check Point Object under SSL Clients - Tick the SSL Network Extender and select the ICA_CERT as the The gateway authenticates with this certificate.

Within the VPN community Tab under your Remote Access community. Add your Gateway as a paricipating gateway.

Within the Users Tab create your users and add these to a new user group.
Create a Rule for to allow access from your usergroups to your internal hosts (local encryption domain) and select your Remote Access Community

Creating a Certificate Based Site to Site VPN between 2 Check Points Gateways

Site A

Create VPN Community

Within your Gateway Object add you local domain to "Topology | VPN Domain | Manually Defined"
Within Network Objects create a Externally Managed VPN gateway (For Site B) and add its local domain.
Goto the VPN communities Tab and Right Click "Site To Site" and select "New" then "Mesh".
Give your Communitiy a name
Select "Accept all encypted traffic"
Within Participates add your Gateways.
Click Ok.
Export the Certificate

Within the Servers and OPSEC applications tab right click "Servers > Trusted CAs > Internal CA" and select "New > CA > Trusted > New CA > Trusted."
Enter a name for your Certificate (such as VPN-CERT)
Under the Certificate Authority TYpe choose "External Check Point CA"
Click the External Check Point CA tab and select "Save As".
Save the Certificate


Site B

Create VPN Community

Within your Gateway Object add you local domain to "Topology | VPN Domain | Manually Defined".
Within Network Objects create a Externally Managed VPN gateway (For Site A) and add its local domain.
Goto the VPN communities Tab and Right Click "Site To Site" and select "New" then "Mesh".
Give your Communitiy a name
Select "Accept all encypted traffic"
Within Participates add your Gateways.
Click Ok.
Import the Certificate

Within the Servers and OPSEC applications tab right click Servers and select "New > CA > Trusted"
Enter a name such as VPN-CERT.
Under the Certificate Authority TYpe choose "External Check Point CA".
Click the External Check Point CA tab and select "Get".
Import the previously saved certificate from Site A.

VPN between Check Point Security Gateway and Cisco Pix fails: "No valid SA"

To resolve this issue proceed as follows:

1. At the Cisco end, check the Crypto Map settings. Find out from the ACLs if there is a host based VPN setup or a network based VPN setup.


2. On SmartDashboard, edit the Cisco Interoperable Device object defined on SmartDashboard. Select 'Network Objects > Others > Interoperable Device > VPN > Advanced'. Uncheck 'Support key exchange for subnets'.
   
   Note: For NGX, select 'Network Objects > Interoperable Device > VPN > Advanced'. Under VPN Tunnel Sharing, select Custom Settings and specify "One VPN tunnel per each pair of hosts".



3. After completing this procedure, initiate traffic from the source PC. You should be able to see an encrypt in SmartView Tracker.