This post describes how to configure a Branch Office VPN (BOVPN) between WatchGuard Firebox on Prem and a Check Point device at my home which is behind my home router.

There are some configuration I found interesting which I mentioned in the following. Local network setting is confusing me although I got it working. It might be because of the specialty of Firebox

Topology

Make Sure Firewalls UDP500 Expose to Internet

UDP500 is IPSEC Protocol. 

Create IPSEC Site2Site VPN Between ...

Since in local site, I am having a home router in front of Checkpoint firewall 192.168.2.22, I will have to open UDP 500 port to checkpoint firewall gateway. 

Create Gateway on each site

1  On CheckPoint Firewall, create a new Interoperable device:

You also can create a VPN Community to add both gateways into settings:

2  On WatchGuard, create a new Branch Office Gateway:

Under the Credential Method section, select Use Pre-Shared Key and enter a same key as you entered in the Checkpoint firewall.

Create Phase 1 (Main) Policy

1  On CheckPoint Firewall,





2  On WatchGuard, 

In this Lab, I am using SHA1 and AES128 with DH Group 2.

Create Phase 2 (Quick) Policy

1  On CheckPoint Firewall,





2  On WatchGuard, 

In this Lab, I am using SHA256 and AES256 with DH Group 14.

One thing I found interesting is to set up local ip. If I set a local route172.x.x.0/24 this kind of network, the tunnel will be failed.  With one static ip could not find route.
If I set it to 172.x.x.x/32 or Any IPv4, the tunnel comes up right away. Strange. 

Default Phase2 Proposal can be changed at VPN menu -> Phase 2 proposals page. 

Create Firewall Policy to Allow VPN Traffic

1  On CheckPoint Firewall,

2  On WatchGuard, it will automatically add two BOVPN rules for inbound and outbound traffic:

Test and Troubleshooting

1  On CheckPoint Firewall,
  • Ping, tracert, VPN tu, and tcpdump -nni any host <Remote VPN Gateway Public IP>
  • Logs to search <Remote VPN Gateway Public IP>

2  On WatchGuard, 

WatchGuard System Manager to reset key and clear error message

Firebox System Manager – Right Click Menu on Gateway – VPN Diagnostic Report

System Manager – Traffic Monitor

References

from Blogger http://blog.51sec.org/2020/12/create-vpn-tunnel-between-checkpoint.html

By Jon

Leave a Reply

%d bloggers like this: