Configuring IPsec Integration

You can route the traffic from a Citrix SD-WAN device to the Internet through IPsec tunnels. Check Point inspects the traffic in these tunnels and secures the users in the office.

Through the IPsec you can enable Check Point security from your Citrix SD-WAN management dashboard.

Note - A WAN Edge IPsec Interface name must have a suffix of _1.

To configure Citrix SD-WAN IPsec on your SD-WAN Device perform these steps:

  1. Creating the First IPsec Check Point Tunnel

  2. Creating the Second IPsec Check Point Tunnel

  3. Routing Traffic through the IPsec Tunnels

  4. Deploying Changes

  5. Testing your Configuration

Creating the First IPsec Check Point Tunnel

Note - A WAN IPsec Interface Name must have a suffix of _1.

To create an IPsec tunnel:

  1. Go to Configuration > New (or, alternatively, Configuration > Open).

    Example:

  2. Go to Configuration page > Virtual WAN > Connection Editor.

  3. In the Connection section select the applicable Site, click Intranet Services and click [+Service].

  4. On the right pane of the window in the WAN Links section configure your WAN interface as your IPsec Source Interface:

  5. Click Apply.

    Example:

  6. Go to Configuration page > Connections tab > IPsec Tunnels.

  7. Click [+] to add a new IPsec Tunnel.

  8. Set these parameters:

    Service type - Set to Intranet and select the new created Intranet service.

  9. On the right pane of the window open the new created WAN link (for example, New_Intranet_Service_1).

    Note - IKE and IPsec Settings/configuration must be configured as stated in the Check Point Infinity Portal Portal instructions.

    Example:

  10.  

    		 Field Settings

    Tunnel Addresses

    Local IP Address

    Configured on the Harmony Connect Site (see Creating a New Site).

    Peer IP Address

    The IP address of the Check Point IPsec tunnel as appear at the previous steps.

    IKE Settings

    IKE Version

    IKEv2 is preferred, IKEv1 is also supported

    Identity

    IP Address

    Authentication

    Pre-Shared Key

    Pre-Shared Key

    Paste the Key generated on the Harmony Connect Site (see Creating a New Site).

    Peer Authentication

    Mirrored

    DH Group

    Group 2 (MODP1024)

    Hash Algorithm

    SHA1

    Identity Algorithm

    SHA1

    Encryption Mode

    AES 256-Bit

    IPsec Settings

    Tunnel Type

    ESP+Auth

    PFS Group

    None

    Encryption Mode

    AES 256-Bit

  11. Go to the IPsec Protect Networks and click [+Add].

    • Source IP/Prefix section enter all the internal sub-networks that in your branch are defined as Internal Sub-Networks at Check Point Site configuration.

    • Destination IP/Prefix - Set to 0.0.0.0/0.

    Example:

Creating the Second IPsec Check Point Tunnel

Repeat Steps 3-11 to create the second WAN link for the second the New_Intranet_Service_2 tunnel.

Routing Traffic through the IPsec Tunnels

  1. Go to Connection > Routes and click [+] to add a new routing rule.

  2. Set these parameters:

    • Network IP Address - Select one of the internal sub-networks behind your branch device. Make it your primary tunnel.

    • Service Type - Set to Internet.

    • Service Name - Set to the first IPsec tunnel configured in the previous steps (see Creating the First IPsec Check Point Tunnel).

    Example:

  3. Create an additional rule for the same sub-networks with the Service Name set to the second IPsec tunnel that you configured at the previous steps.

  4. Repeat Steps 1-3 to configure the New_Intranet_Service_2 tunnel.

  5. Create additional routing rules for the rest of the sub-networks behind your branch device.

Deploying Changes

  1. To save your configuration go to Configuration tab > Virtual WAN > Configuration Editor.

  2. Click Save.

    Example:

  3. Go to Configuration tab > Configuration editor and select the Checkpoint_2tunnels option.

  4. Click Export to stage and activate the configuration.

  5. In the Export Configuration window select Destination > Check Management inbox.

  6. Click Export.

    Example:

  7. Save the changes.

  8. Go to Configuration tab > Virtual WAN > Change Management.

    Example:

  9. Click Next.

    Example:

  10. Click Activate Staged.

    Example:

  11. Wait for the activation to complete.

    Example:

To test your Harmony Connect configuration see Testing your Configuration.