Configuring VPN

This section describes how to configure these VPN configuration scenarios:

• Remote Access VPN An encrypted tunnel between remote access clients (such as Endpoint Security VPN) and a Spark Firewall.

• Site to Site VPN An encrypted tunnel between two or more Spark Firewall Appliances. Synonym: Site-to-Site VPN. Contractions: S2S VPN, S-to-S VPN. using a preshared secret

• Site to Site VPN using a certificate

VPN General Limitations:

• VPN encryption settings must be the same on both sides (the local gateway and the peer gateway). This is especially important when you use the Custom encryption option.

• When changing the configuration from the Locally Managed mode to the Centrally Managed mode and enabling the IPSec VPNSoftware Blade for the first time, it is necessary to:

  • In SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., install the Access Control policy.

  • Run the “sfwd_restart” command in the Expert mode or reboot the Spark Firewall.

• VPN does not work with pure IPv6, only with dual IP stack.

• In Locally Managed appliances, the parameter "vpn_forec_nat_t" does not force NAT-T if the remote site is configured using a hostname.

Configuring Remote Access VPN

Introduction

Use these options for remote access:

• Check Point VPN clients

• Check Point Mobile clients

• Check Point SSL VPN

• L2TP VPN client

Prerequisites

• In VPN > Blade Control, make sure:

  • To set the Remote Access control to On.

  • To select the Allow traffic from Remote Access users (by default) option.

  • To select the applicable connection methods.

  For more details, see Configuring the Remote Access Blade.

• If the gateway uses a dynamic IP address, we recommend you use the DDNS feature. See Configuring DDNS and Access Service.

• For the Check Point VPN client or Mobile client method, make sure that the applicable client is installed on the hosts. Click How to connect for more information.

Limitations

• Remote Access VPN supports connections from IPv4 addresses only.

• Remote Access VPN supports these VPN clients: Check Point VPN clients, Mobile client, SSL VPN, and Windows VPN client.

• The maximum supported number of selected GEO Location objects is 100. See sk182654.

• If you override Remote Access VPN Two-Factor Authentication settings for specific users, these changes take effect only if the global Remote Access VPN Two-Factor Authentication setting is enabled.

• Check Point limits the number of SMS messages that can be sent per gateway per day. For Two-Factor Authentication, the limit is 5 messages in a 24 hour period.

• L2P and SNX do not support Two-Factor Authentication.

• The Layer 2 Tunneling Protocol (L2TP) connection can work when Two-Factor Authentication is enabled, even though L2TP does not support Two-Factor Authentication. Run in Gaia Clish The default shell of the Gaia CLI: set vpn remote-access advanced allow-older-clients true

• The VPN SNX connection can work when Two-Factor Authentication is enabled, even though VPN SNX does not support Remote Access VPN. Run in Gaia Clish: set vpn remote-access advanced allow-older-clients true

• VPN Two-Factor Authentication is per gateway, not administrator.

• When you turn on Two-Factor Authentication, you enable it for all VPN clients. This means all VPN users must have a configured mobile phone number and email address with which to connect.

• DynamicID, a Multi-Factor Authentication for VPN clients, is not supported in Centrally Managed mode.

• When office mode is disabled on Locally Managed 1500 appliances, you can configure a manual rule with Remote Access VPN, but the rule is not enforced.

• During a cluster failover, connected Remote Access VPN users may be disconnected.

• Remote Access SecurID authentication is not supported in Locally Managed mode.

• When you connect to the appliance with Remote Access VPN, the appliance only uses the default internal certificate.

• The "Route all traffic through gateway" option is not supported for SSL Network Extender A secure connectivity framework for remote access VPN to a corporate network. SSL Network Extender uses a thin VPN client installed on the user's remote computer that connects to an SSL-enabled web server on a VPN Gateway. Acronym: SNX. clients.

• Two-Factor Authentication using Mobile Access is not supported.

• The Remote Access VPN feature "Location Aware Connectivity" is not supported on Locally Managed Spark Firewall Appliances.

• MEP is not supported in Remote Access VPN.

• You cannot create a Firewall rule where the source/destination is "Remote Access VPN."

• When User Awareness is turned off, there is no user identification based on Browser-Based Authentication and Active Directory Queries.

• In Locally Managed small office appliances, when a cluster failover happens, Remote Access VPN clients need to re-establish the connection. A different certificate is seen when re-connecting.

• You cannot use these characters in a password or shared secret: { } [ ] ` ~ | ‘ " \ (maximum number of characters: 255)

Remote Access VPN UDP/TCP ports

Remote Access VPN requires these ports to complete tunnel negotiation and establishment:

• UDP 500

• UDP 4500

• UDP 30500

• UDP 34500

When another configuration reserves these ports, the Security Gateway A dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. authenticates the user but cannot complete VPN tunnel establishment.

The VPN daemon "vpnd" listens on these ports on a Security Gateway:

• Tunnel Test: UDP 18234

• L2TP: UDP 1701

• Check Point RDP: UDP 259

• Session infrastructure manager: TCP 9996

The IKE daemon "iked" listens on these ports on a Security Gateway:

• IKE UDP 30500 - 30563

• IKE NAT-TL UDP 34500 - 34563

• Tunnel test: UDP 48234 - 48297

• Check Point RDP: UDP 30259 - 30322

• L2TP: UDP 31701 - 31764

Remote Access Configuration

These are the methods to configure remote access users:

• Local users

• RADIUS users

• AD users

To allow only specified users to connect with a remote access client, set group permissions for the applicable user type. Select the arrow next to the Add option and select the relevant group option. See Configuring Remote Access Users.

To configure new local users:

1. Go to VPN > Remote Access Users.

2. Click Add to add local users.

3. Make sure that the Remote Access permissions checkbox is selected.

For more information, see Configuring Remote Access Users.

To configure existing users:

1. Go to VPN > Remote Access Users.

2. Click Edit to make sure that the Remote Access permissions checkbox is selected.

For more information, see Configuring Remote Access Users.

To configure RADIUS users:

1. Go to VPN > Authentication Servers.

2. Click Configure to add a RADIUS server. See Configuring Authentication Servers for Remote Access.

3. Click permissions for RADIUS users to set access permissions.

To configure AD users:

1. Go to VPN > Authentication Servers and click New to add an AD domain. See Configuring Authentication Servers for Remote Access.

2. Click permissions for Active Directory users to set access permissions.

L2TP VPN Client configuration

For L2TP VPN Client configuration, click L2TP Pre-shared key to enter the key after you enable the L2TP VPN client method.

Advanced Options

For more information on advanced Remote Access options, for example Office Mode network, see Configuring Advanced Remote Access Options.

Monitoring

To make sure Remote Access is working:

Use the configured client to connect to an internal resource from a remote host.

Configuring Site to Site VPN with a Preshared Secret

Introduction

In this Site to Site VPN configuration method a preshared secret is used for authentication.

Prerequisites

• Make sure the Site to Site VPN blade is set to On and Allow traffic from remote sites (by default) is selected. See Configuring the Site to Site VPN Blade.

• The peer device that you connect to must be configured and connected to the network. If it is a DAIP gateway, its host name must be resolvable.

Configuration

Enter a host name or IP address and enter the preshared secret information. For more information, see Configuring VPN Sites.

Monitoring

To make sure the VPN is working:

1. Send traffic between the local and peer gateway.

2. Go to VPN > VPN Tunnels to monitor the tunnel status. See Viewing VPN Tunnels.

Configuring Site to Site VPN with a Certificate

Introduction

In this Site to Site VPN configuration method a certificate is used for authentication.

Prerequisites

• Make sure the Site to Site VPN blade is set to On and Allow traffic from remote sites (by default) is selected. See Configuring the Site to Site VPN Blade.

• The peer device that you connect to must be configured and connected to the network. If it is a DAIP gateway, its host name must be resolvable.

• You must reinitialize certificates with your IP address or resolvable host name. Make sure the certificate is trusted on both sides.

Configuration

1. Reinitialize certificates - Use the Reinitialize certificates option described in Managing Installed Certificates. Make sure this is done on both the local and peer gateway (if they both use locally managed Check Point appliances).

2. Trust CAs on the local and peer gateways - Use one of these procedures:

   • Exchange CAs between gateways

   • Sign a request using one of the gateway's CAs.

   • Authenticate by using a 3rd party CA.

   • Authenticate with an existing 3rd party certificate.

3. Use certificate authentication to create the VPN site.

   1. Follow the instructions in Configuring VPN Sites.

   2. To make sure the specified certificate is used, enter the peer gateway's certificate information in Advanced > Certificate Matching.

Trust Procedures

Exchange CAs between gateways:

Click Add to add the Trusted CA of the peer gateway. This makes sure the CA is uploaded on both the local and peer gateways. See Managing Trusted CAs.

Sign a request using one of the gateway's CAs:

You create a request from one gateway that must be signed by the peer gateway's CA:

1. Use the New Signing Request option in Managing Installed Certificates.

2. Export this request using the Export option.

3. Use the peer gateway's internal CA to sign the request on the peer gateway.

   If the peer gateway is a locally managed Check Point gateway, go to VPN > Trusted CAs and use the Sign a Request option.

   For more information, see Managing Trusted CAs.

4. Upload the signed request to the local gateway.

   1. Go to VPN > Installed Certificates.

   2. Select the installed certificate that you asked the remote peer to sign.

   3. Upload the certificate with the Upload Signed Certificate option.

      See Managing Installed Certificates.

5. Make sure that the CA is installed on both of the gateways. Use the Add option in Managing Trusted CAs.

To authenticate by using a 3rd party CA:

You create a signing request from each peer gateway. Follow the steps above in Sign a request using one of the gateway's CAs to sign it with a 3rd party CA.

Note that a 3rd party CA can issue *.crt, *.p12, or *.pfx certificate files.

1. Upload the certificate using the appropriate upload option.

   1. Go to VPN > Installed Certificates.

   2. Select the installed certificate that you asked the remote peer to sign.

   3. Upload the certificate with the Upload Signed Certificate or Upload P12 Certificate option.

      See Managing Installed Certificates.

2. Make sure that the 3rd party CA is installed on both of the gateways.

   Use the Add option in Managing Trusted CAs.

To authenticate with an existing 3rd party certificate:

1. Create a P12 certificate for the local and peer gateway.

2. Upload the P12 certificate using the Upload P12 Certificate option on each gateway.

3. Make sure that the 3rd party CA is installed on both of the gateways.

   Use the Add option in Managing Trusted CAs.

Monitoring VPN

To make sure the VPN is working:

1. Pass traffic between the local and peer gateway.

2. Go to VPN > VPN Tunnels to monitor the tunnel status.

   See Viewing VPN Tunnels.