Site to Site CheckPoint PaloAlto

Learning outcome

  • Setting up interfaces

  • Setting up static route

  • Setting up IKE Gateway

  • Setting up encryption settings

  • Setting up VPN Tunnel

  • Setting up firewall policies

Scenario: Site-to-Site VPN between Checkpoint 1530 firewall and Palo Alto VM in GNS3

First time configuration for Checkpoint Appliance

  1. Reach to checkpoint web interface via https://192.168.1.1:4434

  2. Complete the First time configuration wizard.

  1. You will get DHCP address at this point by connecting the WAN port to the classroom switch with internet connectivity.

  1. After completing the first time configuration you should be able to access the web portal for Checkpoint.

Setting up Site-to-site VPN

Checkpoint

  1. Navigate to VPN> Site to site > VPN Sites > Create a new site

  2. Specify the peer address of other firewall.

  3. Specify the remote local network under the encryption domain.

  1. Configure the encryption settings and make sure that you use same settings on other firewall as well

Make sure to enable Perfect Forward Secrecy (PFS), by selecting the DH group. (enabled by default on Fortigate and PaloAlto)

  1. Under the advanced tab disable Remote gateway is a Checkpoint Security Gateway.

  1. Add a route for PA remote network going through checkpoint WAN IP

PaloAlto

  1. Configure the interfaces for PaloAlto

Interfaces

IP Address

Zones

Ethernet1/1

DHCP Client

VPN

Ethernet1/1

192.168.10.1/24

In

Tunnel 1

-

VPN

  1. Set up your IKE Gateway, make sure the pre-shared key is correct.

  1. Match your settings for IKE Crypto (phase1) and IPSEC Crypto (phase2)

Match the DH-group with checkpoint settings and by default one group would be selected and PFS would be enabled.

  1. Set up your IPSec Tunnel

In this scenario we are doing site-to-site from PaloAlto to no PaloAlto device, so we have to set up a proxy ID while setting up the tunnel.

  1. Set up static route > virtual router > default > static routes > add new

  1. Set up firewall policies from Inside-VPN and vice-versa.

  1. After this commit your configuration on PaloAlto and your VPN tunnel should be up.Tunnel is up on both firewalls now.

Successful pings from both private networks:

Team

  • Harshdeep Khurana

  • Umair Abdullah

  • Lauren Leam

  • Shahzaib Hussain

  • Sik Yue Law

PreviousSite-to-Site Checkpoint to CiscoNextSite to Site CheckPoint FortiGate

Last updated