Getting Started with Site-to-Site VPN

1. From the left navigation panel, click Security Policies.

2. In the top left section Access Control, click Policy.

3. In the bottom left section Access Tools, click VPN Communities.

4. Click New () and select Star Community or Meshed Community.

5. Enter a name for the VPN Community.

6. In the Center Gateways area, click the + icon to add one or more Security Gateways (Clusters) to be in the center of the community.

7. In the Satellite Gateways area, click the + icon to add one or more Security Gateways (Clusters) to be around the center Security Gateways (Clusters).

8. Click OK.

   The Community uses the default encryption and VPN Routing settings.

9. Optional: Edit more settings for the VPN Community in the VPN Community object.

In addition to the Security Gateway members, you can edit these settings for the VPN Community in the community object:

• Encrypted Traffic - Select Accept all encrypted traffic to encrypt and decrypt all traffic between the Security Gateways. If this is not selected, create rules in the Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. Rule Base All rules configured in a given Security Policy. Synonym: Rulebase. to allow encrypted traffic between community members.

• Encryption - Select encryption settings that include the Encryption Method and Encryption Suite. See VPN Community Object - Encryption Settings.

• Tunnel Management - Select settings for VPN tunnels that include Permanent Tunnels and Tunnel Sharing. See Configuring Tunnel Features.

• VPN Routing -For Star Communities, select how VPN traffic is routed between the center and satellite Security Gateways. By default this is always set to To center only. See Configuring VPN Routing in Domain Based VPN.

• MEP (Multiple Entry Points) - For Star Communities, select how the entry Security Gateway for VPN traffic is chosen. This only applies when you have multiple center Security Gateways in the community. See Overview of MEP.

• Excluded Services - Add services that are not to be encrypted, for example Check Point Control Connections. VPN tunnels are not created for the Services included here.

• Shared Secret - Configure shared secret authentication to use for communication with external Security Gateways that are part of a VPN community. See Configuring a VPN with External Security Gateways Using Pre-Shared Secret.

• Wire Mode - Select to define internal interfaces and communities as trusted and bypass the Security Gateway for some communication. See Configuring Wire Mode.

• Advanced - Configure advanced settings related to IKE, IPsec, and NAT. You can also Reset All VPN Properties to revert all VPN Community settings to their default values. See Configuring Advanced IKE Properties.

1. In SmartConsole, from the Gateways & Servers view, open a Security Gateway object.

2. Open the Network Management > VPN Domain page.

3. Select Manually defined and:

   • Browse to the object list and select an object that represents the domain.

   • Browse to the object list and click New > Group or Network to define a new group of hosts or networks.

4. Click OK.

By default, a Security Gateway's Encryption Domain is shared with all the communities it is a part of.

Access to different resources within the Encryption Domain is implemented using the Access Control Rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session. Base.

In some cases you may need to configure the Encryption Domain in a granular way.

You can configure the VPN domain of a Security Gateway per community, which makes it safer and easier to control the VPN communities that are logically separated.

Example 1

• Security Gateway A (Partner A) is part of Community-1.

• Security Gateway B (Partner B) is part of Community-2.

• Security Gateway C (Corporate Branch) is part of Community 1 and Community 2.

• The network behind Security Gateway C - 10.2.2.0 is split into 2 networks using the 255.255.255.128 subnet mask.

In this scenario, the administrator limits the access from Security Gateway A in Community 1 to some of the resources behind Security Gateway C, which is also part of Community 1.

To allow access to the required resources from Security Gateway A to resources protected by Security Gateway- C, the administrator configures an Encryption Domain per the specific community. On Security Gateway-C, the administrator must configure two Encryption Domains: one for Community 1 and one for Community 2.

Domains

The access is limited to the specific Encryption Domain: network 10.2.2.0/25.

Configuring the Encryption Domain per Community

1. Open the VPN community.

2. From the left tree, click Gateways.

3. In the Center Gateways section, double-click the center Security Gateway that participates in more than one VPN community (Security Gateway- C in this scenario).

   The VPN domain configuration window opens.

   

4. Select the User defined option.

   Select the applicable Network or Group object (or create a new object). Configure the Encryption Domain. In the example, the encryption domain includes the network that we allow partner B to access.



5. Click OK.

Example 2

Using the same setup, you can use the Encryption Domain per Community configuration to allow access between host 1 and host 2 in both directions.

The configuration changes are applied to the Encryption Domain of Security Gateway-C per each relevant community, in this example Communities 1 and 2.

Note - In previous versions to get this functionality the vpn_route.conf file was used.

Configuration:

Community	Encryption Domain	Install On
Community-1	Network behind Security Gateway-C Host-2	Security Gateway-C Security Gateway-A
Community-2	Network behind Security Gateway-C Host-1	Security Gateway-C Security Gateway-B

1. Create a new host (Host-2 behind Security Gateway-B) to represent the Encryption Domain of Security Gateway-C to publish for Security Gateway-A.

2. Create a new host (Host-1 behind Security Gateway-A) to represent the Encryption Domain of Security Gateway-C to publish for Security Gateway-B.

3. Create a new Network group to include the current Encryption Domain of Security Gateway-C and the additional host (Host-2) for Community-1.

4. Create a new Network group to include the current Encryption Domain of Security Gateway-C and the additional host (Host-1) for Community-2.

5. For Community-1 change the Encryption Domain for Security Gateway-C, use the new group created in step 3.

6. For Community-2 change the Encryption Domain for Security Gateway-C, use the new group created in step 4.

This type of configuration "tricks" the satellite gateways to think that the destination host is part of Security Gateway-C 's Encryption Domain. Therefore, the satellite gateways encrypt the packets that they send to the center Security Gateway. The center Security Gateway decrypts the packets, re-encrypts them, and then re-routes them to the other satellite gateways.

This is how it works:

If a Security Gateway participates in more than one VPN Community, you can configure a different VPN Domain for the Security Gateway for each VPN Community in which it participates. In SmartConsole, you can configure a specific VPN Domain for a Security Gateway in the Security Gateway object or in the VPN Community object.

To configure a specific VPN Domain in the Security Gateway Object:

1. Open the Network Management > VPN Domain page.

2. In the line Set Specific Domain for Gateway Communities, click Set.

3. Select the VPN Community for which it is necessary to override the VPN Domain and click Set.

4. Select the applicable option:

   • According to the gateway

     This configuration option use the VPN Domain that is configured in the Network Management folder > VPN Domain page > VPN Domain section.

   • User defined

     Select the applicable Network or Group object (or create a new object).
     

     This configuration option overrides:

     • The VPN Domain that is configured in the Security Gateway object > Network Management folder > VPN Domain page > VPN Domain section.

     • The VPN Domain that is configured in the Meshed / Star VPN Community object > Gateways page.

     • The VPN Domain that is configured in the Remote Access VPN An encrypted tunnel between remote access clients (such as Endpoint Security VPN) and a Security Gateway. Community object > Participating Gateways page.

5. Click OK to close the Set Specific VPN Domain for Gateway Communities window.

6. Click OK to close the Communities Specific VPN Domain window.

To configure a specific VPN Domain in the VPN Community Object:

1. In the Objects pane, click VPN Communities.

2. Click the applicable VPN Community.
   

   The VPN Community configuration window opens.

3. In the Gateways pane, double-click the relevant Security Gateway object (or create a new object).
   

   The VPN Domain configuration window opens.

4. Select the applicable option:
   

   • According to the gateway

     This configuration option use the VPN Domain that is configured in the Network Management folder > VPN Domain page > VPN Domain section.

   • User defined

     Select the applicable Network or Group object (or create a new object).
     

     This configuration option overrides:

     • The VPN Domain that is configured in the Security Gateway object > Network Management folder > VPN Domain page > VPN Domain section.

     • The VPN Domain that is configured in the Meshed / Star VPN Community object > Gateways page.

     • The VPN Domain that is configured in the Remote Access VPN Community object > Participating Gateways page.

5. Click OK to close the VPN Domain configuration window.

6. Click OK to close the VPN Community configuration window.

VPN Gateway excludes its external IP address from the VPN Domain, you must configure the Check Point VPN Gateway to exclude its own external IP addresses from the VPN Domain.

1. From the left navigation panel, click Gateways & Servers.

2. In the center panel, double-click the VPN Gateway / Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. object.

3. From the left tree, expand Network Management and click VPN Domain.

4. Below Advanced, select Exclude gateway's external IP addresses from the VPN Domain.

5. Click OK.

1. Open the VPN Community object.

2. From the left tree, click Encryption.

3. Below Override Encryption for Externally Managed Gateways click the + button.

   The Granular Encryption window opens.

   Example:

   

4. Configure the Encryption Context. Gateways in the Encryption Context use Granular Encryption.

   1. To the right of Internal Gateway, select one:
      

      • Any - All internally managed Gateways that participate in the VPN community use Granular Encryption to communicate with the External Gateway.

      • Security Gateway object - the selected Security Gateway uses Granular Encryption to communicate with the External Gateway.

      Note - Security Gateways that are in the VPN Community appear in the menu. You can add a Security Gateway to the VPN Community in the VPN Community object window > Gateways tab.

   2. To the right of External Gateway, select an Interoperable Device that represents the External Gateway.
      

      Note - To make a new Interoperable Device, in the Objects pane click New > More > Network Object > More > Interoperable Device.

   The Encryption Context is a configuration of an Internal Security Gateway and an Externally Managed Security Gateway.

   The default value for the Internal Gateway is * Any. When * Any is selected, all internal Gateways that participate in the VPN community use the same Encryption Suite to establish the VPN connection with the externally managed Gateway.

   Note - If Granular Encryption is set for a specific Internal Gateway in addition to the use of * Any in a different Encryption Context, the Granular Encryption settings apply.

5. Select the Encryption Method and Encryption Suite to use for the VPN communication between the selected peers.