IPSec VPN with Checkpoint

[Jimmys]

Hi @All

We have established a Site to Site IPsec tunnel with one of our partners checkpoint firewall. And the tunnel is UP on both Phase I and Phase II. There are 5 (Five) encryption domains that exist on a single tunnel. For Outgoing services from our FortiGate to the client (checkpoint) works fine. But for some Incoming services the issue persists that the clients Encryption Domain does not reach our FortiGate end. When we capture traffic using tcp dump on our firewall there is nothing reaching our end.

The client created a support on checkpoint and get the below result implying there is no error on checkpoint's configuration. And indicated the following solution which needs to be done on FortiGate's side. I don't know whether FortiGate have the suggested configuration option.

Can someone suggest what does it mean?

"We can see Check Point offers a universal tunnel (0,0,0,0/0 - 'per GW pair' on tunnel management). Where Forti sends subnets as a proposal for the tunnel. This is a misconfiguration and will need to be addressed in these way - configure the Forti to be a universal tunnel and not offer subnets"

[AEK]

Hi Jimmy

If I understand well Checkpoint support, you just need to add subnet 0.0.0.0/0 to FG's IPsec Phase 2 selectors.

Ref:  https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-add-a-subnet-to-an-existing-IPsec-c...

[Jimmys]

@AEK 

Thank you for immidiate reply.

May be let me explain some additional things found in the IPsec.

The client's encryption domains are private IP's and we have in our FortiGate environment. So, that we told the client to NAT their source IP's to 10.38.0.88 for one service, 10.38.0.89, 10.38.0.90, 10.38.0.91 and 10.38.0.92 all are for different services. In our fotigate we have configured the traffic between these NAT IP's and our server's. One thing to remind you in these is that, One incoming service with source from 10.38.0.89 is working properly. But all other 4 services were not working. 

Can you keep in mind these thing.

SRC: 10.38.0.89 -------------------------> DST: 10.3.90.90 working

SRC: 10.38.0.90 -------------------------> DST:10.3.190.9 Not working
SRC: 10.38.0.91 -------------------------> DST:10.3.10.185 Not working

SRC: 10.38.0.91 -------------------------> DST:10.3.110.167 Not working

SRC: 10.38.0.93 -------------------------> DST:10.3.0.185 Not working

N.B: 10.38.0.0/24 is our subnet that we defined for all incoming traffics through IPSEC VPN for different third parties

If the above case gave you some additional hint. 

Will wait for your reply

[AEK]

Hi Jemmy

Since no traffic is reaching you from 4 sources:

• You may start by "temporarily reconfigure the tunnel's phase 2 selector from both ends (FortiGate & Checkpoint) with 0.0.0.0/0 (or 10.0.0.0/8) for both source and destination
• Your partner may help by sniffing on his firewall to check if the 4 sources' traffic is being correctly forwarded through the tunnel (I guess not)

If the above steps don't show relevant outgoing traffic detected on Checkpoint then I think we will agree that the problem is definitely from your partner's side.