Route Injection Mechanism

In this scenario:

• RIM is enabled in the VPN community in which Security Gateway 1 and Security Gateway 2 participate.

• When the Security Gateways create a VPN tunnel, and the Permanent Tunnel status changes to "UP", RIM updates the routing tables:

  • The routing table on Security Gateway 1 gets the routes for the encryption domain of Security Gateway 2.

  • The routing table on Security Gateway 2 gets the routes for the encryption domain of Security Gateway 1.

• Security Gateway 1 has a dynamic routing neighborship with Router 1 and propagates RIM routes to Router 1.

• Security Gateway 2 has a dynamic routing neighborship with Router 2 and propagates RIM routes to Router 2.

• If the VPN tunnel becomes unavailable (Permanent Tunnel status with a peer changes to "DOWN"), then RIM removes routes from the routing tables of Security Gateway 1 and Security Gateway 2. The Security Gateways update their corresponding neighbors: Router 1 and Router 2. The routers start to send traffic over the leased line.

Below are the routing tables on the Security Gateways and Routers based on the diagram above. Entries in bold represent routes that RIM injected into the Security Gateway's local routing table:

For Security Gateway 1:

Security Gateway 2:

Router 1 (behind Security Gateway 1):

Router 2 (behind Security Gateway 2):

Custom scripts can be run on any Security Gateway in the community. These scripts are executed whenever a tunnel changes its state (example: goes "up" or "down"). Such an event, for example, can be the trigger that initiates a dial-up connection.

There is a script template custom_rim (with a .sh or .bat extension depending on the operating system) in the $FWDIR/scripts/ directory.

Sample customized script:

#!/bin/sh

# This script is invoked each time a tunnel is configured with the RIM option

# and the tunnel changed state.

#

# You may add your custom commands to be invoked here.

# Parameters read from command line.

RIM_PEER_GW=$1

RIM_NEW_STATE=$2

RIM_HA_STATE=$3

RIM_FIRST_TIME=$4

RIM_PEER_ENC_NET=$5

case "${RIM_NEW_STATE}" in

      up)

            # Place your action for tunnels that came up

            ;;

      down)

            # Place your action for tunnel that went down

            ;;

esac

Where:

• RIM_PEER_GW: Peer Security Gateway

• RIM_NEW_STATE: Change in the state of the Security Gateway,(example: up or down).

• RIM_HA_STATE: State of a single Security Gateway in a cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. (example: standby or active).

• RIM_FIRST_TIME: The script is executed separately for each network in the peer's encryption domain. Though the script can be executed multiple times on a peer, this parameter is transferred to the script with the value of '1' only the first time the script runs on the peer. The value '1' indicates the first time this script is executed. The next time the script is executed, it is transferred with the value of '0' and the parameter is disregarded. For example, you can send an email alert to the system administrator the moment a tunnel goes down.

• RIM_PEER_ENC_NET: VPN domain of the VPN peer.

You can inject the IP addresses of the peer Security Gateway into the routing tables, in addition to the networks behind the Security Gateway.

For example, after a VPN tunnel is created, RIM injects the encryption domain of the peer Security Gatewayinto the local routing tables of both Security Gateways.When RIM enabled Security Gateways communicate with a Security Gateway that has Hide NAT enabled, it is necessary to inject the peer's interfaces.

In this scenario:

• Security Gateways A and B are both RIM enabled and Security Gateway C has Hide NAT enabled on the external interface ("hiding" all the IP addresses behind it).

• Host 1, behind Security Gateway C, initiates a VPN tunnel with Host 2, through Security Gateway A.

• Router 3 holds routes to all the hosts behind Security Gateway C. Because Router 3 does not have the Hide NAT IP address of Security Gateway C, Router 3 cannot properly route packets back to Host 1.

To route back packets:

1. In SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on.:

   1. Click Menu > Global properties.

   2. Click VPN Advanced Properties > Tunnel Management.

   3. Select RIM_inject_peer_interfaces. This injects Router 3 with all of the IP addresses of Security Gateway C (this includes the Hide NAT address).

   4. Click OK.

   5. Install the Access Control Policy.

2. Configure the router not to propagate the information injected to other Security Gateways. For example, in the scenario shown above this could result in Security Gateway B routing traffic to Security Gateway C through Security Gateway A.

1. In SmartConsole, click Objects > Object Explorer (or press Ctrl E).

2. From the left tree, select VPN Communities.

3. Open the applicable Star Community object.

4. From the left tree, click Tunnel Management.

5. In the Permanent Tunnels section, select Set Permanent Tunnels.

   These Permanent Tunnels modes are available:

   • On all tunnels in the community

   • On all tunnels of specific Security Gateways

   • On specific tunnels in the community

   Note - RIM can only be enabled on permanent tunnels. If Multiple Entry Point (MEP) is enabled on the community, you must select On all tunnels in the community. See Configuring Tunnel Features.

6. Select Enable Route Injection Mechanism (RIM).

7. Click Settings.

   The Star Community Settings window opens.

   In the Community section:

   • Enable automatic Route Injection Mechanism - RIM runs automatically on the central or satellite Security Gateways.

   • Enable customer editable script execution - A customized script runs on central or satellite Security Gateways whenever a tunnel changes its states (goes up or down).

   In the Tracking section, configure the applicable tracking options: Log, Popup Alert, Mail Alert, SNMP Trap Alert, User Defined Alert

8. Click OK to close all configuration windows.

9. Close the Object Explorer.

10. Install the Access Control Policy.

11. If you selected Enable customer editable script execution, then you must edit the $FWDIR/scripts/custom_rim.sh script on each of the Security Gateways.

1. In SmartConsole, click Objects menu > Object Explorer (or press Ctrl E).

2. From the left tree, select VPN Communities.

3. Open the applicable Meshed Community object.

4. From the left tree, click Tunnel Management.

5. In the Permanent Tunnels section, select Set Permanent Tunnels.

   These Permanent Tunnels modes are available:

   • On all tunnels in the community

   • On all tunnels of specific Security Gateways

   • On specific tunnels in the community

   Note - RIM can only be enabled on permanent tunnels. If Multiple Entry Point (MEP) is enabled on the community, you must select On all tunnels in the community. See Configuring Tunnel Features.

6. Select Enable Route Injection Mechanism (RIM).

7. Click Settings.

   The Meshed Community Settings window opens.

   In the Community section:

   • Enable automatic Route Injection Mechanism - RIM runs automatically on the central or satellite Security Gateways.

   • Enable customer editable script execution - A customized script runs on central or satellite Security Gateways whenever a tunnel changes its state (goes up or down).

   In the Tracking section:

   • Configure the applicable tracking options:

     Log, Popup Alert, Mail Alert, SNMP Trap Alert, User Defined Alert

8. Click OK to close all configuration windows.

9. Close the Object Explorer.

10. Install the Access Control Policy.

11. If you selected Enable customer editable script execution, then you must edit the $FWDIR/scripts/custom_rim.sh script on each of the Security Gateways.

1. In SmartConsole, click Menu > Global properties.

2. Click Advanced > Configure.

3. Click VPN Advanced Properties > Tunnel Management.

4. Select RIM_inject_peer_interfaces.

5. Click OK.

6. Install the Access Control Policy.

RIM automatically configures routes for peer encryption domains in the Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. OS kernel on Security Gateways:

• When a VPN tunnel is up, RIM adds the applicable routes.

• When a VPN tunnel is down, RIM removes the applicable routes.

If the VPN tunnel state changes from "DOWN" to "UP" again, it can take time for the routes for peer encryption domains to appear again in the routing table on Security Gateways. You can configure the Gaia OS kernel to keep these routes even when the VPN tunnel is down.

Configure the applicable settings on Security Gateways in Gaia Portal Web interface for the Check Point Gaia operating system. or in Gaia Clish The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell)..

• Configuration in Gaia Portal:

  1. In the tree view, click Advanced Routing > Routing Options.

  2. In the Kernel Options area, select the Kernel Routes option.

  3. Click Apply.

• Configuration in Gaia Clish:

  1. set kernel-routes on

  2. save config

For Gaia Security Gateways to publish routes, run these Gaia Clish commands on all Center Security Gateways of the VPN Community A named collection of VPN domains, each protected by a VPN gateway..

For more information, see the R82 Gaia Advanced Routing Administration Guide.

1. set routemap <Routemap Name> id <ID Number>

   For example:

   set routemap RIM id 5

2. set routemap <Routemap Name> id <ID Number> match protocol kernel

   For example:

   set routemap RIM id 5 match protocol kernel

3. set ospf export-routemap <Routemap Name> preference 1 on

   For example:

   set ospf export-routemap RIM preference 1 on

4. set routemap <Routemap Name> id <ID Number> allow

   For example:

   set routemap RIM id 5 allow

5. set routemap <Routemap Name> id <ID Number> on

   For example:

   set routemap RIM2 id 10 on

6. set routemap <Routemap Name> id <ID Number> match nexthop <IP Address of OSPF Interface of the other RIM GW> on

   For example:

   set routemap RIM2 id 10 match nexthop <10.16.50.3> on

7. set routemap <Routemap Name> id <ID Number> restrict

   For example:

   set routemap RIM2 id 10 restrict

8. set ospf import-routemap <Routemap Name> preference 1 on

   For example:

   set ospf import-routemap RIM2 preference 1 on

9. save config