How to configure IPsec VPN between on-premises Check Point Security Gateway and Amazon Web Services VPC with static routes and numbered VTIs (2023)

Hilfecenter>search results>safe knowledge details

');$("#keyWordsInput").autocomplete("widget").appendTo("#ac-holder");$("#sc-select-holder").appendTo(document.body);}}) .data( "ui-autocompletar") ._renderItem = función(ul, elemento) {var re = new RegExp("^" + this.term) ;var t = item.label.replace(re,"" + this.term + "");var Klassenname = "ac_even";if (item.index % 2 == 0)classname = "ac_odd";if (item.label == "")return;return $( "

Monitoring:

• The use of Virtual Tunnel Interfaces (VTIs) disabled CoreXL through R80.10.
  Supported by default since R80.10 (through integrated MultiCore VPN). Refer tosk61701.

• QoS is not supported with Virtual Tunnel Interface (VTI). Refer tosk34086.

• Currently, this method is not supported for centrally managed SMB devices (1100, 1200R, 1400).Contact Check Point Supportto get a hotfix for this issue. Refer tosk111840.

• VTIs are not compatible with:

  • 40000/60000 scalable chassis and Maestro R81 and below
  • VSX R80.40 is inferior

Index:

1. AWS configuration

2. Configuration of the operating system Check Point

3. Smart Dashboard Settings

Teil 1: AWS-Setup

1. In the VPC panel, click VPN Connections, then click Create VPN Connection.

   • Provide a name tag.
   • Select Virtual Private Gateway.
   • Select "New" in the customer portal:
     
     • Under IP Address, enter the external IP address of your Check Point Security Gateway (or the cluster's external virtual IP).
     • For "BGP ASN", keep the default value
   • Under "Routing Options" select "Static"
   • Under "Static IP Prefix" enter your local encryption domain in CIDR notation (multiple blocks can be separated with a comma).
     
   • In the following document we use the following notation:
     
     • VPC Subnets:10.10.255.0/2410.10.254.0/24
     • Local encryption domain:192.168.0.0/24 and 192.168.1.0/24

2. After creating the VPN connection item, click Download Configuration. Select "Generic" as the provider.

Part 2: Configuring the Check Point OS on the Security Gateway

Monitoring:If this section is ignored, Security Gateway can sometimes lose the VPN tunnel due to AWS SLA.

Login to your security gateway's Gaia portal.

1. Switch to the "Network Interfaces" tab. Create a new "VPN tunnel" interface, also known as VTI:

   (Video) AWS Site To Site VPN - New video with improved steps (Part 1)

   

   In the downloaded configuration file, read the "IPSec Tunnel #1" section.

   • For "VPN Tunnel ID", choose any unique value (e.g. 1).
   • For Peer, provide a name to identify the VPC tunnel peer (e.g. AWS_VPC_Tun1).
   • Under VPN Tunnel Type, select Numbered
     
     • Under "Local address": Enter the "Internal IP address" of "Client Gateway".as specified in the configuration file. (This refers to a single gateway configuration.)
     • Under "Remote Address": Enter the "Internal IP Address" of the "Virtual Private Gateway" as specified in the configuration file.
       

   • Repeat the above steps to create another VPN tunnel interface with the values ​​specified in the IPsec Tunnel #2 section:

     • For "VPN Tunnel ID", select a different value than the one selected above (e.g. 2).
     • Under "Partner" enter a name to identify the 2nd^{North Dakota}VPC-Tunnel-Peer (als AWS_VPC_Tun2)
     
     

     	member 1	member 2
     VTI Nr. 1 Identification of the VPN tunnel	1	Same as member 1
     VTI Nr. 1 Par	AWS_VPC_Tun1	Same as member 1
     VTI Nr. 1 home address	any unique address*	any unique address*
     VTI Nr. 1 remote address	As specified in the configuration File for IPSec tunnel #1	Same as member 1
     VTI Nr. 2 Identification of the VPN tunnel	2	Same as member 1
     VTI Nr. 2 Par	AWS_VPC_Tun2	Same as member 1
     VTI Nr. 2 home address	any unique address*	any unique address*
     VTI Nr. 2 remote address	As specified in the configuration File for IPSec tunnel #2	Same as member 1

     *Note: The local VTI address (per cluster member) must be different from the addresses specified in the configuration file.These addresses are only meaningful locally and are used to establish the point-to-point connection between Check Point and AWS logical interfaces where next-hop VPN routes are configured for use.

     Monitoring:A two-member cluster requires four unique addresses, one for each VTI, as described above. All other settings can remain the same. A total of six VTI IP addresses would be required; the additional two are the shared addresses that will be defined later in the SmartDashboard.

2. Navigate to the IPv4 Static Routes tab and define the VPN static routes (repeat this step for each subnet in your VPC that you want to route traffic to):

   • Click Add.
   • Specify the VPC subnet.
   • Click Add Gateway and select IP Address.
   • Enter the IP address for the first VPN tunnel remote station (as specified in the configuration file under "Next Hop") and assign it the highest priority (1).
   • Click Add Gateway and select IP Address again.
     
     • Enter the IP address for the second VPN tunnel point and assign it the lowest priority (2).
   • Check the Ping checkbox and click Save.
     
     

     If you are running on a cluster, repeat this step for other members as well.

Part 3 - SmartConsole Configuration

1. Optional: Activate neutral detection.

   Monitoring:Enabling blind spot detection is optional but recommended.

   versk97746.

2. Enable TCP MSS clamp:

   Monitoring:In most cases it is necessary to activate TCP MSS Clamping. Depending on your ISP type, the MSS value provided by AWS might work fine. However, internal testing has shown that it may be necessary to reduce Check Point's MSS capability to 1380 bytes.

   versk101219.

   (Video) Amazon VPC IPSec VPNs - Understanding, Building and Configuring

3. Definition of new network objects:

   1. In SmartConsole, create a new interoperable device:

      • For Name, specify the peer used for the first VTI (e.g. AWS_VPC_Tun1).
        The VTI name must exactly match the hostname in the SmartDashboard.
      • Under "IPv4 Address" use "External IP" from "Virtual Private Gateway" of IPSec tunnel #1.
        
      • Repeat this step for IPSec tunnel #2.

   2. Create an empty simple group object to act as a placeholder for the VPN domain.

4. Looking for the VPN tunnel interfaces:

   (Monitoring:If not already done, enable Blade IPsec VPN on your gateway)

   1. Open your Security Gateway or Cluster object.

   2. Navigate to in the tree on the leftnetwork administrationbook page.

   3. Click on the top toolbarObtener interfaces>Get interfaces with no topology.

      Monitoring:For clusters, define the newly added interfaces as "cluster" interfaces using the IP addresses specified in the configuration file for "Client Gateway":
      

   4. In the tree on the left, click VPN Domain.
   5. Choose "Defined manually" and select the empty simple group object created earlier.

      Monitoring:If you already had a VPN domain configured, you can keep your current settings, but make sure that the hosts and networks used or served by the new VPN connection do not declare themselves in the VPN domain, especially if the VPN domain is automatically derived from ("Based on topology information").

   6. click OK.

5. Creating the VPN community:

   1. In the upper right panelobjects, click on "VPN communities".
      create a new oneEstrellacommunity.

      

   2. Add your Security Gateway or Cluster object as a Center Gateway.
      Add interoperable devices like satellite gateways.

      (Video) How to Setup a VPN Connection between CISCO ASA and AWS VPN?
      

   3. Configure the star community properties:

      1. NO "Cryptography", select "IKEv1 Only". Under "Crypt Suite", select "Custom", click "Custom Cipher..." and select the cipher properties defined in the configuration file.

      2. NO "tunnel management" Select sideOne VPN tunnel per gateway pair". Refer tosk113561.

      3. NO "advanced settings" > "shared secret", configure the pre-shared secret.

         

   4. NO "advanced settings" > "Advanced VPN Properties", to set up:

      • IKE SA lifetime (renegotiation time)
      • IPsec SA Lifetime (Renegotiation Time
      • IPsec Perfect Forwarding Secret
      
   5. CliqueOK.

6. Create firewall rules (required if you specify a community in the VPN column):

   1. Openglobal propertiesand navigate toVPN>Progressive.

      Choose "Activate VPN direction matching in the VPN column".

      CliqueOK.

      

   2. For each firewall rule related to VPN traffic, add the following directional match rules in the VPN column:

      • Internal_clear > AWS VPN-Community
      • AWS VPN-Community > AWS VPN-Community
      • AWS VPN-Community > Internal_clear

      To create a directed match rule, right-click the VPN cell in the rule and click Edit Cell. In the VPN Match Conditions window, select Match traffic in this direction only. To add routes, click Add.

      Monitoring:Enabling direction matching rules globally in SmartConsole does not affect previously configured working VPN rules. These continue to work as expected.

      

7. Install policy.

   (Video) AWS - Setup Site-to-Site VPN Connection

Related solutions:

• sk113840 - How to configure IPsec VPN between on-premises Check Point Security Gateway (R81 and below) and Amazon Web Services VPC using static routes without VTI
• sk108958 - How to configure IPsec VPN between on-premises Check Point Security Gateway and Amazon Web Services VPC using dynamic routes and numbered VTIs