1

I have a checkpoint VSX environment running r81 and I have a DMZ firewall that has two external interfaces. One that goes to the Internet and one that goes to a 10.0.0.0/8 network that connects to other departments across a campus.

I am trying to setup a VPN with a remote gateway that sits on 10.0.0.0/8 network. But when my FW tries to initialize the VPN it sends the traffic out the correct interface but it NATs the source IP as my Internet-facing IP address. The engineers at the remote end 10.104.208.4 has confirmed that they are receiving IKE packets with my public IP as its source ip address. It should be receiving packets with my 10.124.96.3 address as the source. As a result the VPN is failing to establish itself.

Network Diagram - Apologies for the basic hand drawn diagram (public IP has been changed) enter image description here

fw monitor -ci 50 -co 50 -e "accept [12,b]=10.104.208.4 or [16,b]=10.104.208.4;"

[vs_3][fw_0] eth1-04.2781:o[44]: 192.168.196.49 -> 10.104.208.4 (UDP) len=180 id=60240 UDP: 500 -> 500

[vs_3][fw_0] eth1-04.2781:O[44]: 71.71.71.71 -> 10.104.208.4 (UDP) len=180 id=60240 UDP: 12275 -> 500

Firewall Topology

enter image description here

Interface eth1-04.2780 is the Internet facing IP.

When I ping 10.104.208.4 from the same firewall it then nats the traffic properly and I get a reply.

[vs_3][fw_1] eth1-04.2781:o[44]: 192.168.196.49 -> 10.104.208.4 (ICMP) len=84 id=55137 ICMP: type=8 code=0 echo request id=20194 seq=2

[vs_3][fw_1] eth1-04.2781:O[44]: 10.124.96.3 -> 10.104.208.4 (ICMP) len=84 id=55137 ICMP: type=8 code=0 echo request id=22565 seq=2

[vs_3][fw_1] eth1-04.2781:i[44]: 10.104.208.4 -> 10.124.96.3 (ICMP) len=84 id=29532 ICMP: type=0 code=0 echo reply id=22565 seq=2

[vs_3][fw_1] eth1-04.2781:I[44]: 10.104.208.4 -> 192.168.196.49 (ICMP) len=84 id=29532 ICMP: type=0 code=0 echo reply id=20194 seq=2

IPSec VPN Settings

I have tried creating a static NAT rule for that 192.168.196.49 address but no luck. I feel like the answer is in the IPSEC VPN settings on firewall. I have tried pretty much every option on this tab! And currently the Source IP Address Settings... are set as follows.

enter image description here enter image description here

Does anyone know what I am doing wrong? Many thanks for any help.

Improve this question

1 Answer 1

Reset to default
0

After two sessions with Checkpoint and them creating labs over the Easter weekend to figure out what was going on, they then realised that VPN Link Selection is not supported currently in the VSX environment. enter image description here

We are currently going back to the Checkpoint for a solution.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.