# Site to Site CheckPoint FortiGate

### **Learning outcome**

* Setting up interfaces
* Setting up static route
* Setting up IKE Gateway
* Setting up encryption settings
* Setting up VPN Tunnel
* Setting up firewall policies

### **Scenario: Site-to-Site VPN between Checkpoint 1530 firewall and FortiGate VM in GNS3**

![](https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2F57yrmM8Z0sQBKyKBmD9y%2F4.png?alt=media)

### &#x20;<a href="#id-8wayenvfpf5x" id="id-8wayenvfpf5x"></a>

### Giving the licensing to our Fortigate device <a href="#q52uhv1e5mn9" id="q52uhv1e5mn9"></a>

![](https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FXqwKPZyzw9jnvJrYhgIE%2F8.png?alt=media)

* Now we are going drop a NAT to our configuration field and when dragging it to your field make sure you choose a server as GNS3 Vm (GNS3 VM) and press ok

![](https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FP2kAqCUYIxTLEbCETxVd%2F9.png?alt=media)

* Now we are going to connect an FortiGate interface port to our the NAT using port 1 make sure you use PORT 1

![](https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FYTk3Psv1iltyCHsrvR3B%2F11.png?alt=media)

* Before you start your FortiGate device lets give more RAM to our device so it can run smoothly. Right click on the **FortiGate > Configure > change the RAM form 1024MB to 4096MB > Apply > OK**

![](https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2Fx5df78LRY2gVoo00C2wp%2F12.png?alt=media)

![](https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FMKljmxRxfMFyfuVsxYOW%2F14.png?alt=media)

* Now you can right click on the device and press start

![](https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FHt3knBJfr0Do5APnYcpu%2F15.png?alt=media)

* Now that you connect your NAT to FortiGate device you should be getting a Licensing and it should look like this. (Take a screenshot)

![](https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2F4f93iTQjbxnJaI939H8O%2F17.png?alt=media)

* If you did not get any IP address you can go to that port which is port 1 and give a DHCP address.

Username: Admin

Password: Abc\@1234

* Config system **interface > edit port1 > set mode dhcp > end**

![](https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FSpgiEAMHAErEcPBru9bq%2F18.png?alt=media)

* To see if you have an IP address DHCP go > show system interface ?

![](https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FE9fD41nXAH4bQBsIAFem%2F19.png?alt=media)

* Now by this time you should be getting an licensing

### Let's set up our topology for site to site <a href="#z911nvt69aol" id="z911nvt69aol"></a>

* Disconnect your FortiGate device from the NAT and bring a webterm to your configuration field, and one cloud, we are going to be using that cloud to connect to our check point.
* When bring cloud to your device make sure you go with ST-16 if your doing in Hardware and press OK

![](https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FBbrstl1wD5ki8vAq6Pbv%2F21.png?alt=media)

* Now let's set up a static IP address for our webterm so right click on your webterm > configuration > click on edit on Network Configuration > and remove the #, follow the image for better understanding to give a static ip address.

![](https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FDxkjlYUHmuZdybA6bjOX%2F22.png?alt=media)

![](https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FmcGdY3cvSHWpAuG4qbod%2F23.png?alt=media)

Save > apply > ok

* Now let's connect eth0 to our port2 of our FortiGate device. And right click on your webterm > start

![](https://lh7-us.googleusercontent.com/33rbVvkBvp6wYCGhi5UEcxhW7jjW4bLuLk-0SvUx7Vg3YdVRWDUyuy-_fJD6LgScLovOtHyqDnoAVa-Wfr1F9SElrVKwv8F7SpQr_b95IV22fcMgwPKaG8Y067zUuI-eaRjqiAyCtjRFew4Y_qXQQaw)

* And now let's connect port 1 from FortiGate to our eth2 going to cloud. And start your FortiGate

![](https://lh7-us.googleusercontent.com/-8azk1x8D2dUqjYxZ6K7w-cLnYHcncDk84281TCVW-zeROVD-9EQV2XgLB3_w3Ps-G6W_UXeBeWSLc7rj9Qv02FSwNuB0OLvFmK1CttyZHk0CqLN5OZSo4n9c3zVSwgV1G3y1DT3v4OrlZZCYij3UVs)

### Putting IP Address in our FortiGate device <a href="#mcc6lsxjprrm" id="mcc6lsxjprrm"></a>

* Go show the system interface ? > to see your DHCP address the port that is connected to the cloud.

![](https://lh7-us.googleusercontent.com/5YgRR6SNCg46j2zCymExSFSKjMwagSZ555ZsRLl-NROZ1CFgqOA1AyqWQqQLiLMwD2k5m-Z-P_3HnbbdUKMQ6uCBJeL48u_tRJY44VxBpp3YTa_AzdEE9cDo4bYOFbAm_uqcKZkLYk3uhv6R1N6rg1E)

* Open your browser in your webterm or your host computer and go > [http://142.232.197.149](http://142.232.197.149/) in my case (Take a screenshot)

Username: Admin

Password: Abc\@1234

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FphtSOI5FYVm1qYynfwKs%2Fimage.png?alt=media&#x26;token=adf7f333-b47f-4bd3-aea6-395ab9fba598" alt=""><figcaption></figcaption></figure>

### Let's enter our Check point device <a href="#n6haygcmyl0x" id="n6haygcmyl0x"></a>

* Once you connect your check point devices and everything is right go on your cmd on your host machine and type in the command ipconfig.
* You should be able to see your check point IP address and you should get an IP address, And then go on your browser and type the Default gateway browser for example [http://192.168.10.1:4434](http://192.168.10.1:4434/)&#x20;
* Now install your checkpoint and set your IP address and your setting and then press login

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FtAo9fN7xR8jHiTGHde57%2Fimage.png?alt=media&#x26;token=aa633276-17d4-4345-983b-74099201c097" alt=""><figcaption></figcaption></figure>

* Now to see our DHCP IP address go on **Device > Internet**:

![](https://lh7-us.googleusercontent.com/E6HTUcV-Cq9YI3BNtHcxMms1hgNoAbwy0Rg6jG3hXFMJtxWcZWXKHKdrLb5ieOZbShdirb137OceL5xosk_Oq6Ayd4A3KSVLTY26pZyM6U9UmWL7pkd1yiLoMrXbILVMPSAhN0TDNE-LoIxCUFpXru0)

* Make sure you remember this IP address

### Now let's give IP address to our FortiGate <a href="#pepn06heteru" id="pepn06heteru"></a>

* Click on Network > Interface > port 1 > Manual > set the address as your DHCP address in my case it will be 142.232.197.149/24 > mark ping > ok&#x20;

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2F099krGnuZ5BF4lWEflam%2Fimage.png?alt=media&#x26;token=2df6dd90-869e-4ac8-87dd-77c2f6bcb214" alt=""><figcaption></figcaption></figure>

* Click on Network > interface > port 2 > Manual > put the address of your customer site for Fortigate in my case 192.168.50.1/24 > check ping > ok

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2Fw0z7KwIKbLCvKwh63Edx%2Fimage.png?alt=media&#x26;token=9b1ce55e-1218-4cff-a437-eee91aa7dcef" alt=""><figcaption></figcaption></figure>

### Let's set up our IPSec tunnel <a href="#qyx1itlmpgfc" id="qyx1itlmpgfc"></a>

* Click on VPN > IPsec tunnel > Create New > IPsec tunnel > click on custom > Name it > Click next > Network > IP address and give it check point IP address DHCP&#x20;

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2Fr0e0ToaPdzUl5WYX2KB1%2Fimage.png?alt=media&#x26;token=89668c90-87b9-422d-8925-66a4cb001195" alt=""><figcaption></figcaption></figure>

* In the Authentication section put your password **MAKE SURE THAT PASSWORD IS THE SAME WITH CHECK POINT**

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FPBViXYERMmGWueopQfGk%2Fimage.png?alt=media&#x26;token=a9627766-e381-478b-9b32-e7bf32d2db24" alt=""><figcaption></figcaption></figure>

* And now we will configure Phase 1 Proposal, **MAKE SURE YOU CHOOSE THE SAME FOR YOUR CHECK POINT AND MATCH THEM** FortiGate address going to your check point site.

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FdFJLWc2qzhoYoFTDqsL6%2Fimage.png?alt=media&#x26;token=6f8bab3b-a2d8-43fe-9c2e-b6634063cc99" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FagT1hFtmtemjrKyWsJme%2Fimage.png?alt=media&#x26;token=6a9dfbb1-8a80-42cc-b668-d8f3be94fa31" alt=""><figcaption></figcaption></figure>

* Click on New Phase2 > advanced > keep the enable Replay Detection > check Enable perfect Forward secrecy (PFS)

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2F7wz09qUMQDWXVRqZSbmg%2Fimage.png?alt=media&#x26;token=252cf26e-35ef-4da5-991c-6a61478eb7dd" alt=""><figcaption></figcaption></figure>

* And for phase 2 proposal keep it like this **MAKE SURE IT IS THE SAME AS YOUR CHECK POINT**

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FBk4uBqXLnG3AYUfHh6c9%2Fimage.png?alt=media&#x26;token=84e3639d-d600-4707-a8d9-4d6fd6aac2b1" alt=""><figcaption></figcaption></figure>

8. Now let's set up static route in our FortiGate device

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FDkx5BodC6GNAW2r0p7fB%2Fimage.png?alt=media&#x26;token=cf816f20-b48b-459e-8220-aced468fac68" alt=""><figcaption></figcaption></figure>

* Network > Static route > Create New > Destination will be the check point IP address site and the interface will be your site to site and press ok.

### Create our FortiGate Policy <a href="#qme2ajiur35j" id="qme2ajiur35j"></a>

* Click on Policy & Objects > Firewall Policy > Create New > we need to create 2 policies, one outgoing and one incoming.
* In our first policy the incoming will be port 2 the port connects to our customer site and the outgoing will be our site to site. And on destination you can go all, all, all but it is not a good practice YOU HAVE TO CHANGE IT LATER BASE ON YOUR CONFIGURATION.

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2F2tEwbkZIp3AlVBMEFOkZ%2Fimage.png?alt=media&#x26;token=be91b4b7-675e-4b33-a809-638e7048cf53" alt=""><figcaption></figcaption></figure>

* For our second policy we do the opposite checkpoint to our FortiGate client, you can go all, all, all but it is not a good practice YOU HAVE TO CHANGE IT LATER BASED ON YOUR CONFIGURATION > and press ok.

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FHVs5xYHrOkUBgBa43YPj%2Fimage.png?alt=media&#x26;token=a5b9b657-0311-4fbc-ae5d-e7a768151ade" alt=""><figcaption></figcaption></figure>

### Configure our Check point <a href="#f2404p3vzbeb" id="f2404p3vzbeb"></a>

* Login to your check point and click on VPN > VPN sites > New > IP address this IP is going to be your DHCP FortiGate address > Pre-shared secret put a password MAKE SURE IT IS THE SAME PASSWORD AS YOUR FORTIGATE DEVICE > Object Name add the Client for FortiGate > Apply&#x20;

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FeiEdAhommVr2RzMDUI7J%2Fimage.png?alt=media&#x26;token=06270baf-c0a9-4794-a5c9-02501f05b066" alt=""><figcaption></figcaption></figure>

* NOTE MAKE SURE THE ENCRYPTION IS THE SAME AS YOUR FORTIGATE AND CHECKPOINT PHASE 1 AND PHASE 2 ENCRYPTION MATCH

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2Fym2AQMRM2uBwR3TYp2Nk%2Fimage.png?alt=media&#x26;token=acbe8669-c87b-4363-973c-d2674662ac1d" alt=""><figcaption></figcaption></figure>

* AND MAKE SURE YOU CLICK “Enable perfect forward secrecy (better security, affects performance) BOTH ON CHECKPOINT AND FORTIGATE

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FXmlkwKFHjcqQOwJGLFt1%2Fimage.png?alt=media&#x26;token=2f326d5e-e477-43e6-b84c-37b219641a6e" alt=""><figcaption></figcaption></figure>

### Let's set up an Access Policy for our Checkpoint <a href="#mg69xor60uid" id="mg69xor60uid"></a>

* Access Policy > Incoming click New > Any > Destination will be your DHCP of the FortiGate device > service ICMP > Action Accept > ok&#x20;

### Testing <a href="#u9la2tb3u7hx" id="u9la2tb3u7hx"></a>

* Going back to your FortiGate device click on IPsec tunnels and click on bring up it should be green and up meaning our tunnel work.&#x20;

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2Fcdb3Myt7NYv4ZIQsfxek%2Fimage.png?alt=media&#x26;token=bbfd8f39-3a1f-4742-9c1c-e58811396f2c" alt=""><figcaption></figcaption></figure>

* Now I am going to ping our checkpoint IP address to see if our VPN is working and if I can reach the Checkpoint.

<figure><img src="https://4205952620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTb2cXetEhnrsGY0WszQ3%2Fuploads%2FLfYEE3EgdJ18jmMWhwoy%2Fimage.png?alt=media&#x26;token=c6c9854a-0a3c-468e-9f81-5dbe17c6dbf9" alt=""><figcaption></figcaption></figure>

#### Team:

* Mohammad Jowkari
* Harkamal Dhami
* Ajay Rana
* Trishanjeet Mutti
