I have a checkpoint VSX environment running r81 and I have a DMZ firewall that has two external interfaces. One that goes to the Internet and one that goes to a 10.0.0.0/8 network that connects to other departments across a campus.
I am trying to setup a VPN with a remote gateway that sits on 10.0.0.0/8 network. But when my FW tries to initialize the VPN it sends the traffic out the correct interface but it NATs the source IP as my Internet-facing IP address. The engineers at the remote end 10.104.208.4 has confirmed that they are receiving IKE packets with my public IP as its source ip address. It should be receiving packets with my 10.124.96.3 address as the source. As a result the VPN is failing to establish itself.
fw monitor -ci 50 -co 50 -e "accept [12,b]=10.104.208.4 or [16,b]=10.104.208.4;"
[vs_3][fw_0] eth1-04.2781:o: 192.168.196.49 -> 10.104.208.4 (UDP) len=180 id=60240 UDP: 500 -> 500
[vs_3][fw_0] eth1-04.2781:O: 18.104.22.168 -> 10.104.208.4 (UDP) len=180 id=60240 UDP: 12275 -> 500
Interface eth1-04.2780 is the Internet facing IP.
When I ping 10.104.208.4 from the same firewall it then nats the traffic properly and I get a reply.
[vs_3][fw_1] eth1-04.2781:o: 192.168.196.49 -> 10.104.208.4 (ICMP) len=84 id=55137 ICMP: type=8 code=0 echo request id=20194 seq=2
[vs_3][fw_1] eth1-04.2781:O: 10.124.96.3 -> 10.104.208.4 (ICMP) len=84 id=55137 ICMP: type=8 code=0 echo request id=22565 seq=2
[vs_3][fw_1] eth1-04.2781:i: 10.104.208.4 -> 10.124.96.3 (ICMP) len=84 id=29532 ICMP: type=0 code=0 echo reply id=22565 seq=2
[vs_3][fw_1] eth1-04.2781:I: 10.104.208.4 -> 192.168.196.49 (ICMP) len=84 id=29532 ICMP: type=0 code=0 echo reply id=20194 seq=2
IPSec VPN Settings
I have tried creating a static NAT rule for that 192.168.196.49 address but no luck. I feel like the answer is in the IPSEC VPN settings on firewall. I have tried pretty much every option on this tab! And currently the Source IP Address Settings... are set as follows.
Does anyone know what I am doing wrong? Many thanks for any help.